PatchSiren

PatchSiren cyber security CVE debrief

CVE-2014-9772 Nodejs CVE debrief

CVE-2014-9772 describes an XSS filter bypass where hex-encoded characters could evade filtering and let attacker-controlled content reach a browser context. NVD rates the issue 6.1 (MEDIUM) with network access, no privileges, and user interaction required. The main defensive concern is that applications relying on this package for XSS protection may assume input has been normalized or blocked when it has not.

Vendor
Nodejs
Product
Node.js
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Teams running Node.js applications that depend on the validator package, security owners responsible for web output encoding, and maintainers of products that trust this library to block script-bearing input.

Technical summary

The NVD record classifies the weakness as CWE-79 (Cross-Site Scripting) and gives the vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The description says the validator package before 2.0.0 can be bypassed with hex-encoded characters, while the NVD CPE criteria list vulnerable node.js versions up to 1.8.4. Treat the exact scope carefully and verify the dependency path in your environment.

Defensive priority

Medium. Remediate promptly because this is an input-filter bypass affecting XSS defenses, but the record indicates user interaction is required and no availability impact is noted.

Recommended defensive actions

  • Inventory applications and services that depend on the validator package or any bundled Node.js component that uses it for XSS filtering.
  • Upgrade or replace affected versions, and verify the exact vulnerable range in your dependency tree against the NVD record and package advisory.
  • Review every rendering path that consumes user input and ensure output encoding is applied at the last possible step.
  • Do not rely on a single validation filter as the only XSS control; use layered defenses such as context-aware output encoding and safe templating.
  • Validate the fix in a controlled test environment with encoded-input cases to confirm the application now rejects or neutralizes bypass attempts.
  • If immediate patching is not possible, isolate the affected functionality and add compensating controls around the impacted input-to-output paths.

Evidence notes

Source evidence includes the NVD CVE record, which lists CWE-79 and the CVSS 3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The record references a 2016-04-20 mailing-list advisory, a SecurityFocus entry (BID 97102), and NodeSecurity advisory 43. The corpus also shows a scope discrepancy: the narrative description refers to validator package versions before 2.0.0, while the NVD CPE criteria list node.js versions up to 1.8.4.

Sources and references

Verified primary and authoritative sources

  • CVE-2014-9772 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2014-9772

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2014-9772 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2014-9772

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.