What is GHSA-2xv3-h762-ccxv?

GHSA-2xv3-h762-ccxv is a security advisory published by GitHub Security Advisories with Medium severity. Out-of-bounds Read in concat-with-sourcemaps

Why does GHSA-2xv3-h762-ccxv have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-2xv3-h762-ccxv?

GHSA-2xv3-h762-ccxv affects 1 product, including: npm/concat-with-sourcemaps:\u003e= 1.0.0, \u003c 1.0.6.

GHSA-2xv3-h762-ccxvMediumDisclosed before NVD

Out-of-bounds Read in concat-with-sourcemaps

Vendor

GitHub Security Advisories

Published

May 29, 2019

Last Modified

January 9, 2023

📋 Description

Versions of concat-with-sourcemaps before 1.0.6 allocates uninitialized Buffers when a number is passed as a separator.

Recommendation

Update to version 1.0.6 or later.

🎯 Affected products1

npm/concat-with-sourcemaps:>= 1.0.0, < 1.0.6

🔗 References (4)

https://hackerone.com/reports/320166
https://github.com/floridoo/concat-with-sourcemaps/blob/v1.0.5/index.js#L18
https://www.npmjs.com/advisories/644
https://github.com/advisories/GHSA-2xv3-h762-ccxv