01 Record

CVE-2020-8265

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls

UnratedPUBLISHEDCNA: hackerone

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 9.01% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 94.8% of scored records. A rank, not a probability.
NVD base score: 8.1 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2021-01-06 21:01Z5 YR AGO

Last updated

2025-04-30 22:24Z1 YR AGO

Reserved

2020-01-28

Assigning CNA

hackerone

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-416Use After FreeVariant

Data version

5.1

Document digest

a595031be5cab5c8930454f8c967d75c1cfba37c6b0624c81a4164a9874e61cb

05 Affected products

VendorProductVersionsPlatforms

NodeJSNode4.0 to < 4.*, 5.0 to < 5.*, 6.0 to < 6.*, 7.0 to < 7.*, 8.0 to < 8.*, 9.0 to < 9.*, 10.0 to < 10.23.1, 11.0 to < 11.*, 12.0 to < 12.20.1, 13.0 to < 13.*, 14.0 to < 14.15.4, 15.0 to < 15.5.1—

06 References

nodejs.orghttps://nodejs.org/en/blog/vulnerability/january-2021-security-releases/x_refsource_MISC
hackerone.comhttps://hackerone.com/reports/988103x_refsource_MISC
www.debian.orgDSA-4826https://www.debian.org/security/2021/dsa-4826vendor-advisoryx_refsource_DEBIAN
lists.fedoraproject.orgFEDORA-2021-fb1a136393https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/vendor-advisoryx_refsource_FEDORA
security.gentoo.orgGLSA-202101-07https://security.gentoo.org/glsa/202101-07vendor-advisoryx_refsource_GENTOO
lists.fedoraproject.orgFEDORA-2021-d5b2c18fe6https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/vendor-advisoryx_refsource_FEDORA
www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2021.htmlx_refsource_MISC
security.netapp.comhttps://security.netapp.com/advisory/ntap-20210212-0003/x_refsource_CONFIRM
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfx_refsource_CONFIRM

01 Record index

CVE-2020-8265

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2020-8265

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References