What is GHSA-4xcv-9jjx-gfj3?

GHSA-4xcv-9jjx-gfj3 is a security advisory published by GitHub Security Advisories with Medium severity. Denial of Service in mem

Why does GHSA-4xcv-9jjx-gfj3 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-4xcv-9jjx-gfj3?

GHSA-4xcv-9jjx-gfj3 has a CVSS v3 base score of 5.1, published by GitHub Security Advisories.

Which products are affected by GHSA-4xcv-9jjx-gfj3?

GHSA-4xcv-9jjx-gfj3 affects 1 product, including: npm/mem:\u003c 4.0.0.

GHSA-4xcv-9jjx-gfj3MediumCVSS 5.1Disclosed before NVD

Denial of Service in mem

Vendor

GitHub Security Advisories

Published

July 5, 2019

Last Modified

January 9, 2023

📋 Description

Versions of mem prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after a value passes its maxAge property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.

Recommendation

Upgrade to version 4.0.0 or later.

🎯 Affected products1

npm/mem:< 4.0.0

🔗 References (5)

https://github.com/sindresorhus/mem/commit/da4e4398cb27b602de3bd55f746efa9b4a31702b
https://bugzilla.redhat.com/show_bug.cgi?id=1623744
https://www.npmjs.com/advisories/1084
https://snyk.io/vuln/npm:mem:20180117
https://github.com/advisories/GHSA-4xcv-9jjx-gfj3