GitHub Advisoryadvisory · npm

GHSA-v6gv-fg46-h89j Sensitive Data Exposure in put

LOW Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
put
Severity
Low
Weaknesses
CWE-200
Reviewed
2020-08-31

Affected packages

• npm put: all versions (no fix yet)

Description

All versions of `put` are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This vulnerability only affects versions of Node.js <=6.x. Recommendation Upgrade your Node.js version or consider using an alternative package.

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References