GMS-2020-93: Out-of-bounds Read in base64url

September 1, 2020 (updated September 24, 2021)

Versions of base64url are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js. ## Recommendation

Update to or later.

References

github.com/advisories/GHSA-rvg8-pwq2-xj7q
github.com/brianloveswords/base64url/pull/25
hackerone.com/reports/321687
www.npmjs.com/advisories/658

Code Behaviors & Features

Detect and mitigate GMS-2020-93 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →