Unrated severityNVD Advisory· Published Sep 18, 2020· Updated Apr 30, 2025
CVE-2020-8252
CVE-2020-8252
Description
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
18- osv-coords15 versionspkg:bitnami/nodepkg:bitnami/node-minpkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-packagingpkg:rpm/opensuse/nodejs10&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/nodejs12&distro=openSUSE%20Leap%2015.2pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP1pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2
>= 10.0.0, < 10.22.1+ 14 more
- (no CPE)range: >= 10.0.0, < 10.22.1
- (no CPE)range: >= 10.0.0, < 10.22.1
- (no CPE)range: < 1.18.3-1.module_el8.3.0+2023+d2377ea3
- (no CPE)range: < 17-3.module_el8.4.0+2224+b07ac28e
- (no CPE)range: < 10.22.1-lp152.2.6.1
- (no CPE)range: < 12.18.4-lp152.3.6.1
- (no CPE)range: < 10.22.1-1.27.1
- (no CPE)range: < 10.22.1-1.27.1
- (no CPE)range: < 10.22.1-1.30.1
- (no CPE)range: < 10.22.1-1.27.1
- (no CPE)range: < 10.22.1-1.27.1
- (no CPE)range: < 10.22.1-1.27.1
- (no CPE)range: < 10.22.1-1.27.1
- (no CPE)range: < 12.18.4-1.20.1
- (no CPE)range: < 12.18.4-4.6.1
Patches
Vulnerability mechanics
References
8- lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.htmlmitrevendor-advisoryx_refsource_SUSE
- lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.htmlmitrevendor-advisoryx_refsource_SUSE
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/mitrevendor-advisoryx_refsource_FEDORA
- security.gentoo.org/glsa/202009-15mitrevendor-advisoryx_refsource_GENTOO
- usn.ubuntu.com/4548-1/mitrevendor-advisoryx_refsource_UBUNTU
- hackerone.com/reports/965914mitrex_refsource_MISC
- nodejs.org/en/blog/vulnerability/september-2020-security-releases/mitrex_refsource_MISC
- security.netapp.com/advisory/ntap-20201009-0004/mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.