CVE-2020-8252

Node.js 14 and 1 other: Classic Buffer Overflow (CWE-120)

CVE-2020-8252 is fixed in 10 products on 2 platforms, first by Node.js 14 14.9.0, released August 27, 2020. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms

CVSS

7.8

Moderate

Exploitation

None reported

No vendor assessment

CISA KEV

Not listed

Not in the Known Exploited Vulnerabilities catalog

EPSS

0.0071

53rd percentile

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Where it's fixed

Product	Fixed in	Fix	Released
Windows apps
Node.js 10	10.23.2	Node.js 10 10.23.2	Jan 26, 2021
Node.js 14	14.9.0	Node.js 14 14.9.0	Aug 27, 2020
Linux
libuv1 · Ubuntu 20.04 LTS (focal)	1.34.2-1ubuntu1.1	libuv1 1.34.2-1ubuntu1.1	Sep 18, 2020
nodejs · RHEL 8	1:10.23.1-1.module+el8.3.0+9502+012d8a97	RHSA-2021:0548	Feb 16, 2021
nodejs · ol 8	1:12.18.4-2.module+el8.2.0+7806+0b44ae23	ELSA-2020-4272	Oct 20, 2020
nodejs-devel · RHEL 8	1:10.23.1-1.module+el8.3.0+9502+012d8a97	RHSA-2021:0548	Feb 16, 2021
nodejs-devel · ol 8	1:12.18.4-2.module+el8.2.0+7806+0b44ae23	ELSA-2020-4272	Oct 20, 2020
nodejs-docs · RHEL 8	1:10.23.1-1.module+el8.3.0+9502+012d8a97	RHSA-2021:0548	Feb 16, 2021
nodejs-docs · ol 8	1:12.18.4-2.module+el8.2.0+7806+0b44ae23	ELSA-2020-4272	Oct 20, 2020
nodejs-full-i18n · RHEL 8	1:10.23.1-1.module+el8.3.0+9502+012d8a97	RHSA-2021:0548	Feb 16, 2021
nodejs-full-i18n · ol 8	1:12.18.4-2.module+el8.2.0+7806+0b44ae23	ELSA-2020-4272	Oct 20, 2020
nodejs-nodemon · RHEL 8	0:1.18.3-1.module+el8+2632+6c5111ed	RHSA-2021:0548	Feb 16, 2021
nodejs-nodemon · ol 8	0:1.18.3-1.module+el8.1.0+5393+aaf413e3	ELSA-2020-4272	Oct 20, 2020
nodejs-packaging · RHEL 8	0:17-3.module+el8+2873+aa7dfd9a	RHSA-2021:0548	Feb 16, 2021
nodejs-packaging · ol 8	0:17-3.module+el8.1.0+5393+aaf413e3	ELSA-2020-4272	Oct 20, 2020
npm · RHEL 8	1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97	RHSA-2021:0548	Feb 16, 2021
npm · ol 8	1:6.14.6-1.12.18.4.2.module+el8.2.0+7806+0b44ae23	ELSA-2020-4272	Oct 20, 2020

Details

Published
September 18, 2020
Weakness
CWE-120: Classic Buffer Overflow (CWE-120)
Vendor advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-8252

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/cve/CVE-2020-8252">CVE-2020-8252 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Is this on your machines?

Patchblox finds every install below the fixed version on Windows, macOS and Linux, and updates them through your release rings.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.