Rule Definition
All versions before Node.js 6.14.3, 8.11.3, 9.11.2 and 10.4.1:
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. This rule has been listed as CVE-2018-7167 in the CVE registry.
Remediation
Update the Node.js library to have a fixed Buffer implementation
Violation Code Sample
Buffer.alloc(100).fill(Buffer.alloc(0))
Buffer.alloc(100).fill(Buffer.from(''))
Buffer.alloc(100).fill(new Uint8Array([]))
Buffer.alloc(100, Buffer.alloc(0))
Buffer.alloc(100, new Uint8Array([]))
new Buffer(10).fill(new Buffer(''))
Reference
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7167
Related Technologies
Technical Criterion
Secure Coding - Weak Security Features
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.