What’s Vulnerable › Vulnerabilities

CVE-2020-8174

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-07-24 · updated 2026-06-17
• Weakness: CWE-119

Description

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

Affected products

• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• OnCommand Insight: all versions
• NetApp OnCommand Workflow Automation: all versions
• NetApp SnapCenter: all versions
• Node.js: before 10.21.0; from 12.0.0 before 12.18.0; from 14.0.0 before 14.4.0 — fixed in 10.21.0, 12.18.0, 14.4.0
• Oracle Banking Extensibility Workbench: 14.3.0, 14.4.0
• Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
• Oracle Corporation MySQL Cluster: through 7.3.30; from 7.4.0 through 7.4.29; from 7.5.0 through 7.5.19; from 7.6.0 through 7.6.15; from 8.0.0 through 8.0.21
• Oracle Corporation Retail Xstore Point of Service: 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1

How to fix

Upgrade to a fixed version: Node.js 10.21.0, 12.18.0, 14.4.0; Oracle Blockchain Platform 21.1.2. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/784186
• https://security.gentoo.org/glsa/202101-07
• https://security.netapp.com/advisory/ntap-20201023-0003/
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://hackerone.com/reports/784186
• https://security.gentoo.org/glsa/202101-07
• https://security.netapp.com/advisory/ntap-20201023-0003/
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html

Get alerted when CVE-2020-8174 or the next vulnerability affects your stack