GHSA-9jh3-4pc9-hq29

node-bluetooth-serial-port is vulnerable to Buffer Overflow via the findSerialPortChannel

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-26109

Packages

Ecosystem	Package	Affected	Fixed in
npm	node-bluetooth-serial-port	<= 2.2.7	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-26109 advisory
https://github.com/tinyprinter/node-bluetooth-serial-port package
https://security.snyk.io/vuln/SNYK-JS-NODEBLUETOOTHSERIALPORT-3311820 web