Executive brief
memjs is a Node.js client library for interacting with memcached servers. A vulnerability in how the library constructs buffers allows an attacker to pass large values that exhaust system memory and crash the application, resulting in service unavailability.
Technical details
The vulnerability exists in memjs versions prior to 1.2.2, where the value option passed to the Buffer constructor is not properly sanitized. An attacker can supply oversized values that cause excessive memory allocation, leading to denial of service. The attack requires network access to an application using memjs and no authentication. The vulnerability has a CVSS score of 9.1 (Critical) due to high impact on availability and partial confidentiality concerns. A fix is available in version 1.2.2 and later.
Affected products
- memjs memjs prior to 1.2.2
Timeline
- 2018-10-10: disclosed
- 2018: patched: Fix available in version 1.2.2