CVE-2018-21270: Node.js

Medium severity, CVSS 6.5. EPSS: 3.7% chance of exploitation in the next 30 days.

Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).

Affected products

• Node.js Node.js: before 0.0.6 (fixed in 0.0.6)

Published 2020-12-03. Last modified 2026-06-17.