crypto.randomBytes = function(len, cb) {
    var buf = Buffer.alloc(len);
    buf.fill(0x00);
    if (cb)
        cb(null, buf);
    return buf;
};
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.