GitHub Advisoryadvisory · npm

GHSA-cx8m-8xmx-q8v3 Denial of Service in memjs

CRITICAL Published 2018-10-10 Modified 2023-09-12 Official page ↗
Aliases
CVE-2018-3767
Ecosystem
npm
Packages
memjs
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm memjs: <= 1.2.0 (no fix yet)

Description

Versions of `memjs` prior to 1.2.2 are vulnerable to Denial of Service (DoS). The package fails to sanitize the `value` option passed to the Buffer constructor, which may allow attackers to pass large values exhausting system resources. Recommendation Upgrade to version 1.2.2 or later.

Related

Alias · CVE (1)

  • CVE-2018-3767 `memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References