PatchSiren

PatchSiren cyber security CVE debrief

CVE-2014-9772 Nodejs CVE debrief

CVE-2014-9772 describes an XSS filter bypass where hex-encoded characters could evade filtering and let attacker-controlled content reach a browser context. NVD rates the issue 6.1 (MEDIUM) with network access, no privileges, and user interaction required. The main defensive concern is that applications relying on this package for XSS protection may assume input has been normalized or blocked when it has not.

Vendor
Nodejs
Product
CVE-2014-9772
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Teams running Node.js applications that depend on the validator package, security owners responsible for web output encoding, and maintainers of products that trust this library to block script-bearing input.

Technical summary

The NVD record classifies the weakness as CWE-79 (Cross-Site Scripting) and gives the vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The description says the validator package before 2.0.0 can be bypassed with hex-encoded characters, while the NVD CPE criteria list vulnerable node.js versions up to 1.8.4. Treat the exact scope carefully and verify the dependency path in your environment.

Defensive priority

Medium. Remediate promptly because this is an input-filter bypass affecting XSS defenses, but the record indicates user interaction is required and no availability impact is noted.

Recommended defensive actions

  • Inventory applications and services that depend on the validator package or any bundled Node.js component that uses it for XSS filtering.
  • Upgrade or replace affected versions, and verify the exact vulnerable range in your dependency tree against the NVD record and package advisory.
  • Review every rendering path that consumes user input and ensure output encoding is applied at the last possible step.
  • Do not rely on a single validation filter as the only XSS control; use layered defenses such as context-aware output encoding and safe templating.
  • Validate the fix in a controlled test environment with encoded-input cases to confirm the application now rejects or neutralizes bypass attempts.
  • If immediate patching is not possible, isolate the affected functionality and add compensating controls around the impacted input-to-output paths.

Evidence notes

Source evidence includes the NVD CVE record, which lists CWE-79 and the CVSS 3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The record references a 2016-04-20 mailing-list advisory, a SecurityFocus entry (BID 97102), and NodeSecurity advisory 43. The corpus also shows a scope discrepancy: the narrative description refers to validator package versions before 2.0.0, while the NVD CPE criteria list node.js versions up to 1.8.4.

Official resources

Public advisory material cited in the record dates to 2016-04-20, and the NVD CVE record was published on 2017-01-23. The record was later modified on 2026-05-13; that date reflects record maintenance, not the vulnerability issue date.