GHSA-86mr-6m89-vgj3: 
JavaScript vulnerability analysis and mitigation

A buffer overflow vulnerability was identified in node-weakauras-parser (GHSA-86mr-6m89-vgj3), affecting versions >= 1.0.4, < 1.0.5, >= 2.0.0, < 2.0.2, and >= 3.0.0, < 3.0.1. The vulnerability was discovered and reviewed on August 31, 2020, and published to the GitHub Advisory Database on September 3, 2020. The issue was classified as having moderate severity and was associated with CWE-120 (GitHub Advisory).

The vulnerability stems from the encode_weakaura function's failure to properly validate input size. Specifically, when processing a buffer of 13835058055282163711 bytes, it causes an overflow condition on 64-bit systems. The issue was related to capacity calculation in the base64 encoding functionality (GitHub Commit).

The buffer overflow vulnerability could potentially lead to memory corruption on affected systems, particularly when processing large input buffers on 64-bit systems (GitHub Advisory).

The vulnerability affects the DEFLATE-compressed input processing rather than direct user input, which may limit its exploitability (GitHub Commit).

Users are recommended to upgrade to the patched versions: 1.0.5, 2.0.2, or 3.0.1 or later, which contain fixes for the buffer overflow vulnerability (GitHub Advisory).