CVE-2018-21270 — nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure

Back Back to CVE browser

MEDIUM

nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure

Published Dec 3, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 3.68%

Description

Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).

Affected products

Red Hat Quay 3

quay/quay-rhel8:v3.6.0-62

Fixed · RHSA-2021:3917
Red Hat OpenShift Container Platform 3.11

kibana

Not affected
Red Hat OpenShift Container Platform 4

kibana

Not affected
Red Hat OpenShift Container Platform 4

openshift4/ose-logging-kibana6

Not affected
Red Hat OpenShift Container Platform 4

openshift4/ose-metering-hadoop

Not affected

Product	Package	State	Advisory
Red Hat Quay 3	quay/quay-rhel8:v3.6.0-62	Fixed	RHSA-2021:3917
Red Hat OpenShift Container Platform 3.11	kibana	Not affected	n/a
Red Hat OpenShift Container Platform 4	kibana	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift4/ose-logging-kibana6	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift4/ose-metering-hadoop	Not affected	n/a

Ecosystem	Package	Introduced	Fixed
npm	stringstream	0	0.0.6

Remediation

Red Hat statement

Red Hat Quay include stringstream as a dependency of Karma. Karma is only used at build time, and not at runtime reducing the impact of this vulnerability to low.

Metrics

3.68% 0.03682

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.03682

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v5

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	3.68% (0.03682)	89.33th	v5 (v2026.06.15)
Jun 15, 2026	3.64% (0.03638)	88.06th	v5 (v2026.06.15)
Jul 20, 2024	0.21% (0.00211)	59.47th	v3 (v2023.03.01)
Aug 19, 2023	0.21% (0.00211)	58.24th	v3 (v2023.03.01)
Jul 10, 2023	0.18% (0.00185)	54.72th	v3 (v2023.03.01)
Mar 7, 2023	0.16% (0.00159)	50.55th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00954)	16.28th	v2 (v2022.01.01)
Feb 3, 2022	0.83% (0.00833)	24.58th	v1
Jan 6, 2022	0.83% (0.00833)	23.96th	v1
Sep 1, 2021	0.83% (0.00833)	57.50th	v1
Apr 14, 2021	0.83% (0.00833)	0.00th	v1

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (9)

https://access.redhat.com/security/cve/CVE-2018-21270
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1927293
Issue Tracking
https://github.com/advisories/GHSA-mf6x-7mm4-x2g7
Advisory
https://github.com/mhart/StringStream/blob/v0.0.5/stringstream.js#L32
https://github.com/mhart/StringStream/issues/7
x_refsource_MISCIssue TrackingThird Party Advisory
https://hackerone.com/reports/321670
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-21270
https://www.cve.org/CVERecord?id=CVE-2018-21270
https://www.npmjs.com/advisories/664
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-21270		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1927293		Issue Tracking
https://github.com/advisories/GHSA-mf6x-7mm4-x2g7		Advisory
https://github.com/mhart/StringStream/blob/v0.0.5/stringstream.js#L32
https://github.com/mhart/StringStream/issues/7		x_refsource_MISCIssue TrackingThird Party Advisory
https://hackerone.com/reports/321670		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-21270
https://www.cve.org/CVERecord?id=CVE-2018-21270
https://www.npmjs.com/advisories/664		x_refsource_MISCExploitThird Party Advisory