CVE-2015-6764
Node.js 4: The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in…
CVE-2015-6764 is fixed in Node.js 4 on 1 platform by Node.js 4 4.2.3 (version 4.2.3), released December 3, 2015. It is not reported as exploited. Patch Radar priority: Urgent.
Urgent
CVSS
9.8
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0573
93rd percentile
The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.2.3 | Node.js 4 4.2.3 | Dec 3, 2015 |