CVE-2020-8252: Fedoraproject Fedora

High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Affected products

• Fedoraproject Fedora: version 33 only
• Node.js Node.js: from 10.0.0, before 10.22.1 (fixed in 10.22.1); from 12.0.0, before 12.18.4 (fixed in 12.18.4); from 14.0.0, before 14.9.0 (fixed in 14.9.0)
• Opensuse Leap: version 15.2 only

Published 2020-09-18. Last modified 2026-06-17.