CVE-2017-3731: Truncated packet could crash via OOB read

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 57.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-05-04 · updated 2026-06-17
Weakness: CWE-125

Description

If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.

Affected products

Node.js: from 4.0.0 through 4.1.2; from 4.2.0 before 4.7.3; from 5.0.0 through 5.12.0; from 6.0.0 through 6.8.1; from 6.9.0 before 6.9.5; from 7.0.0 before 7.5.0 — fixed in 4.7.3, 6.9.5, 7.5.0
OpenSSL: 1.1.0a, 1.1.0b, 1.1.0c, 1.0.2, 1.0.2-beta1, 1.0.2-beta2 (+10)

How to fix

Upgrade to a fixed version: Node.js 4.7.3, 6.9.5, 7.5.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-3731 or the next vulnerability affects your stack