GHSA-4xcv-9jjx-gfj3

Suggest an improvement
Source
https://github.com/advisories/GHSA-4xcv-9jjx-gfj3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/07/GHSA-4xcv-9jjx-gfj3/GHSA-4xcv-9jjx-gfj3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4xcv-9jjx-gfj3
Downstream
Published
2019-07-05T21:07:58Z
Modified
2021-08-17T15:44:45Z
Severity
  • 5.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Denial of Service in mem
Details

Versions of mem prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after a value passes its maxAge property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.

Recommendation

Upgrade to version 4.0.0 or later.

Database specific 
{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-07-03T20:52:42Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

npm / mem

Package

Name
mem
View open source insights on deps.dev
Purl
pkg:npm/mem

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/07/GHSA-4xcv-9jjx-gfj3/GHSA-4xcv-9jjx-gfj3.json"