{"cve":"CVE-2018-7167","nvd":{"published":"2018-06-13T16:29:01.860","modified":"2026-10-08T22:16:48.373","status":"Modified","description":"Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS \"Boron\"), 8.x (LTS \"Carbon\"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-119"],"references":["http://www.securityfocus.com/bid/106363","https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/","https://security.gentoo.org/glsa/202003-48","http://www.securityfocus.com/bid/106363","https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/"],"products":["nodejs:node.js"],"source":"nvd","synced_at":"2026-10-19T20:51:47.459859389+00:00"},"epss":{"cve":"CVE-2018-7167","score":0.06689,"percentile":0.93855,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}