CVE-2024-21524

All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling ToBuffer, ToString, or CharAt on a StringBuilder object with a non-empty string value input. It's possible to return previously allocated memory, for example, by providing negative indexes, leading to an Information Disclosure.

• CWE-125
• CWE-125

• https://gist.github.com/dellalibera/0bb022811224f81d998fa61c3175ee67Exploit, Third Party Advisory
• https://github.com/magiclen/node-stringbuilder/blob/5c2797d3d6bf8cb6d10fe1e077609cef9a5a7de0/src/node-stringbuilder.c%23L1281Broken Link
• https://security.snyk.io/vuln/SNYK-JS-NODESTRINGBUILDER-6421617Exploit, Third Party Advisory
• https://gist.github.com/dellalibera/0bb022811224f81d998fa61c3175ee67Exploit, Third Party Advisory
• https://github.com/magiclen/node-stringbuilder/blob/5c2797d3d6bf8cb6d10fe1e077609cef9a5a7de0/src/node-stringbuilder.c%23L1281Broken Link
• https://security.snyk.io/vuln/SNYK-JS-NODESTRINGBUILDER-6421617Exploit, Third Party Advisory

Published

Jul 10, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21519This affects versions of the package opencart/opencart from …7.2
• CVE-2024-2152A vulnerability, which was classified as critical, has been …9.8
• CVE-2024-21520Versions of the package djangorestframework before 3.15.2 ar…6.1
• CVE-2024-21521All versions of the package @discordjs/opus are vulnerable t…7.5
• CVE-2024-21522All versions of the package audify are vulnerable to Imprope…7.5
• CVE-2024-21523All versions of the package images are vulnerable to Denial …7.5
• CVE-2024-21525All versions of the package node-twain are vulnerable to Imp…8.3
• CVE-2024-21526All versions of the package speaker are vulnerable to Denial…7.5
• CVE-2024-21527Versions of the package github.com/gotenberg/gotenberg/v8/pk…8.2
• CVE-2024-21528All versions of the package node-gettext are vulnerable to P…5.9
• CVE-2024-21529Versions of the package dset before 3.1.4 are vulnerable to …8.8
• CVE-2024-2153A vulnerability, which was classified as critical, was found…9.8