What is GHSA-cx8m-8xmx-q8v3?

GHSA-cx8m-8xmx-q8v3 is a security advisory published by GitHub Security Advisories with Critical severity. Denial of Service in memjs

Which CVE IDs does GHSA-cx8m-8xmx-q8v3 cover?

GHSA-cx8m-8xmx-q8v3 covers the following CVE IDs: CVE-2018-3767. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cx8m-8xmx-q8v3?

GHSA-cx8m-8xmx-q8v3 has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-cx8m-8xmx-q8v3?

GHSA-cx8m-8xmx-q8v3 affects 1 product, including: npm/memjs:\u003c= 1.2.0.

GHSA-cx8m-8xmx-q8v3CriticalCVSS 9.1

Denial of Service in memjs

Vendor

GitHub Security Advisories

Published

October 10, 2018

Last Modified

September 12, 2023

🔗 CVE IDs covered (1)

CVE-2018-3767 →

📋 Description

Versions of memjs prior to 1.2.2 are vulnerable to Denial of Service (DoS). The package fails to sanitize the value option passed to the Buffer constructor, which may allow attackers to pass large values exhausting system resources.

Recommendation

Upgrade to version 1.2.2 or later.

🎯 Affected products1

npm/memjs:<= 1.2.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-3767
https://hackerone.com/reports/319809
https://github.com/advisories/GHSA-cx8m-8xmx-q8v3
https://www.npmjs.com/advisories/970