Memory Exposure in concat-stream
Moderate severity
GitHub Reviewed
Published
Jun 3, 2019
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Package
Affected versions
>= 1.5.0, < 1.5.2
>= 1.4.0, < 1.4.11
>= 1.3.0, < 1.3.2
Patched versions
1.5.2
1.4.11
1.3.2
Description
Reviewed
Jun 3, 2019
Published to the GitHub Advisory Database
Jun 3, 2019
Last updated
Jan 9, 2023
Versions of
concat-streambefore 1.5.2 are vulnerable to memory exposure if userp provided input is passed intowrite()Versions <1.3.0 are not affected due to not using unguarded Buffer constructor.
Recommendation
Update to version 1.5.2, 1.4.11, 1.3.2 or later.
If you are unable to update make sure user provided input into the
write()function is not a number.References