地图 / Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)

Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)

内存破坏 / 整数溢出 / #3760016

厂商: Node.js
严重程度: 中危 · CVSS 7.5
赏金: —
弱点: 整数溢出
研究员: @erichen
披露日期: 2026-06-25
资产: https://github.com/nodejs/node
CVE: CVE-2026-48933

该报告还没有中文解读。

时间线

2026-05-25报告提交
2026-06-25公开披露

阅读 HackerOne 原文 ↗作者 @erichen · 版权归作者与 Node.js 所有

同类报告

Integer overflow leading to buffer overflowInternet Bug Bounty · 2019-09-25 · $1,000 Integer overflow in CipherUpdateInternet Bug Bounty · 2021-04-08 Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.cInternet Bug Bounty · 2019-10-21 Integer overflow vulnerabilityGlovo · 2022-05-17 Cookie Max-Age Integer Overflow Vulnerabilitycurl · 2026-01-19 Integer Overflow in schannel.c TLS Data Transmissioncurl · 2025-08-02

Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS) · 破甲 POJIA