VULNERABILITY INTELLIGENCE

CVE-2014-5256

CVSS score5 MEDIUM
EPSS probability3.29%
CISA KEVNot currently listed
Published2014-09-05
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:N/I:N/A:P

Description

Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.

Weakness classification

  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Primary references