Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

The ability to redefine static class fields in Node.js can have significant consequences. Attackers could potentially manipulate class behavior, overwrite critical methods, or inject malicious code. This could lead to denial of service, arbitrary code execution, or data breaches, depending on the application's architecture and how it utilizes static class fields. The impact is particularly severe in applications heavily reliant on class inheritance and static members.

Applications and services built on Node.js, particularly those utilizing static class fields extensively, are at risk. Development teams using older versions of Node.js (213.21.24) and those with limited security monitoring practices are especially vulnerable.

1. 2024-10-16Disclosure

   disclosure

1. Gereserveerd2024-10-09
2. Gepubliceerd2024-11-22
3. Gewijzigd2024-11-23
4. EPSS bijgewerkt2026-04-02

Due to the lack of a specific fixed version, mitigation strategies focus on minimizing the attack surface. Consider isolating Node.js processes with restricted permissions to limit the potential damage from exploitation. Thoroughly review and audit code that utilizes static class fields for any unexpected or malicious modifications. Monitor Node.js logs for unusual activity related to class definitions. Stay informed about official security advisories from the Node.js project for updates and potential workarounds.