Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.

Recommendation

Update to version 3.0.0 or later.

References

• https://hackerone.com/reports/321687
• brianloveswords/base64url#25
• brianloveswords/base64url@4fbd954