CVE-2021-39131

Description

ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a `Buffer` using `Buffer.isBuffer(obj)`.

Weakness classification

• security-advisories@github.com: CWE-241
• nvd@nist.gov: CWE-755

Primary references

• security-advisories@github.com — Patch, Third Party Advisory
• security-advisories@github.com — Release Notes, Third Party Advisory
• security-advisories@github.com — Exploit, Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Third Party Advisory