GHSA-4xcv-9jjx-gfj3 Denial of Service in mem
Attackers can exhaust system memory by abusing application logging due to a cache cleanup failure in the mem library.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-4xcv-9jjx-gfj3?
GHSA-4xcv-9jjx-gfj3 is a denial of service vulnerability in mem, published on 5 Jul 2019. It can be exploited over the network, with no action from the victim.
Official description
Versions of mem prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after a value passes its maxAge property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.
Recommendation
Upgrade to version 4.0.0 or later.
Which versions are affected by GHSA-4xcv-9jjx-gfj3?
2 open source packages ship an affected version, including mem.
| Package | Affected | Fixed in |
|---|---|---|
mem npm | All versions | 4.0.0 |
mem npm | All versions | 4.0.0 |
How do I fix GHSA-4xcv-9jjx-gfj3?
Upgrade mem to 4.0.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-4xcv-9jjx-gfj3 being exploited?
There is no known exploitation of GHSA-4xcv-9jjx-gfj3 in the wild and no public exploit code.