Detections
Analytics

SCA: security update for workerd (GHSA-8vx6-69vg-c46f)

high Tenable Self-Hosted Container Security Plugin ID 412882

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a
 FormData instance contained more than 2^31 elements, the forEach() method could end up reading from the
 wrong location in memory while iterating over elements. This would most likely lead to a segmentation
 fault, but could theoretically allow arbitrary undefined behavior. In order for the bug to be exploitable,
 the process would need to be able to allocate 160GB of RAM. Due to this, the bug was never exploitable on
 the Cloudflare Workers platform, but could theoretically be exploitable on deployments of workerd running
 on machines with a huge amount of memory. Moreover, in order to be remotely exploited, an attacker would
 have to upload a single form-encoded HTTP request of at least tens of gigabytes in size. The application
 code would then have to use request.formData() to parse the request and formData.forEach() to iterate over
 this data. Due to these limitations, the exploitation likelihood was considered Low. A fix that addresses
 this vulnerability has been released in version v1.20230419.0 and users are encouraged to update to the
 latest version available. (CVE-2023-2512)

See Also

https://github.com/advisories/GHSA-8vx6-69vg-c46f

Plugin Details

Severity: High

ID: 412882

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-2512

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/12/2023

Vulnerability Publication Date: 5/12/2023

Reference Information

CVE: CVE-2023-2512