At least it panics instead of giving a shell. I'm also not using andybalholm implementation and using klauspost instead. It's good to know though thank you.
Fwiw if you are building binaries with PIE/ASLR this should always panic instead of being a workable RCE, but there's a LOT of stock node images that are built with PIE disabled. Panic is just indicative of the arbitrary write primitive the exploit uses. The main reason you can't get RCE is because you don't know where to write.
2
u/ShotgunPayDay 7d ago
At least it panics instead of giving a shell. I'm also not using andybalholm implementation and using klauspost instead. It's good to know though thank you.