Description
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Remediation
References
https://hackerone.com/reports/966347
https://lists.debian.org/debian-lts-announce/2021/06/msg00028.html
Related Vulnerabilities
CVE-2018-3758 Vulnerability in npm package express-cart
CVE-2022-22931 Vulnerability in maven package org.apache.james:james-server
CVE-2023-37909 Vulnerability in maven package org.xwiki.platform:xwiki-platform-menu-ui
CVE-2020-28191 Vulnerability in maven package org.togglz:togglz-console
CVE-2021-39176 Vulnerability in npm package detect-character-encoding