`base64-url` below 2.0 allocates uninitialized Buffers when number is passed in input
该报告还没有中文解读。
原文摘录
摘自原文（2237 字符中的一小部分）
I would like to report an uninitialized Buffer allocation issue in `base64-url`. It allows to extract sensitive data from uninitialized memory or to cause a DoS by passing in a large number, in setups where typed user input can be passed (e.g. from JSON).
原文中的代码
664945 react-native 346288 metro-bundler 83764 hubot 81089 sails 51724 phonegap 45522 csrf-tokens 28326 hubot-mock-adapter 25778 mock-hubot 23712 connect-phonegap 18808 nodedata
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Node.js third-party modules 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @chalker · 版权归作者与 Node.js third-party modules 所有