CVE-2018-7167

Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.

• CWE-119

• http://www.securityfocus.com/bid/106363Third Party Advisory, VDB Entry
• https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/Vendor Advisory
• https://security.gentoo.org/glsa/202003-48Third Party Advisory
• http://www.securityfocus.com/bid/106363Third Party Advisory, VDB Entry
• https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/Vendor Advisory
• https://security.gentoo.org/glsa/202003-48Third Party Advisory

Published

Jun 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7159The HTTP parser in all current versions of Node.js ignores s…5.3
• CVE-2018-7160The Node.js inspector, in 6.x and later is vulnerable to a D…8.8
• CVE-2018-7161All versions of Node.js 8.x, 9.x, and 10.x are vulnerable an…7.5
• CVE-2018-7162All versions of Node.js 9.x and 10.x are vulnerable and the …7.5
• CVE-2018-7164Node.js versions 9.7.0 and later and 10.x are vulnerable and…7.5
• CVE-2018-7166In all versions of Node.js 10 prior to 10.9.0, an argument p…7.5
• CVE-2018-7169An issue was discovered in shadow 4.5. newgidmap (in shadow-…
• CVE-2018-7170ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 all…5.3
• CVE-2018-7171Directory traversal vulnerability in Twonky Server 7.0.11 th…
• CVE-2018-7172In index.php in WonderCMS before 2.4.1, remote attackers can…
• CVE-2018-7173A large loop in JBIG2Stream::readSymbolDictSeg in xpdf 4.00 …
• CVE-2018-7174An issue was discovered in xpdf 4.00. An infinite loop in XR…