Buffer Initialization Issue in Node.js Versions 8.X and 9.X

CVE-2017-15897

What is CVE-2017-15897?

Node.js versions 8.X and 9.X contained a bug that could lead to uninitialized buffers when the encoding of the fill value did not match the encoding specified. For instance, using 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' could result in a buffer that was not properly initialized. To address this issue, the implementation has been updated so that any mismatched encoding will result in the buffer being initialized to all zeros, enhancing the security and stability of applications relying on Node.js.

References