CVE-2018-7166

CVE-2018-7166 describes an argument processing flaw in Node.js versions prior to 10.9.0, where Buffer.alloc() can return uninitialized memory instead of safely cleared memory. This vulnerability affects Node.js and arises when a numeric encoding argument is misinterpreted as a fill operation's start index. With a CVSS score of 7.5 (HIGH), this vulnerability has a network attack vector and low attack complexity, potentially leading to high confidentiality impact by exposing sensitive information from uncleared memory blocks. There is no integrity or availability impact. There is no evidence of active exploitation, nor are there known Metasploit, Nuclei, or ExploitDB modules available. Community discussion and media coverage for this CVE are minimal, indicating low public attention.