GHSA-8w4h-3cm3-2pm2

GitHub Security Advisory

Out-of-bounds Read in atob

✓ GitHub Reviewed CRITICAL Has CVE

Versions of `atob` before 2.1.0 uninitialized Buffers when number is passed in input on Node.js 4.x and below.

## Recommendation

Update to version 2.1.0 or later.

npm atob

Affected versions: 0 (fixed in 2.1.0)

CVE-2018-3745

GHSA ID

GHSA-8w4h-3cm3-2pm2

Published

October 9, 2018 12:56 AM

Last Modified

March 1, 2023 1:22 AM

CVSS Score

9.0 /10

Primary Ecosystem

npm

Primary Package

atob

GitHub Reviewed

✓ Yes

Last updated: November 25, 2025 6:29 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.