Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Low severity, with a CVSS score of 3.1, published 5 July 2019.
- Which products and versions are affected?
- mem (npm) SEMVER:introduced=0,fixed=4.0.0.
- Is there a fix for This vulnerability?
- Yes. mem (npm): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked with local access, in a software library.
- Am I affected?
- Check whether you run mem (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mem (npm): upgrade to 4.0.0 or later
npm install mem@4.0.0
Technical details
The vulnerability is a memory leak (CWE-400) in the mem memoization library. The root cause is that the cache fails to delete expired entries even after they pass their maxAge threshold, allowing stale cached results to accumulate indefinitely in memory. The attack vector is local with high complexity, requiring the attacker to be able to cause the application to repeatedly invoke cached functions. An attacker who can abuse application logging or trigger repeated function calls can exhaust system memory, leading to denial of service. The vulnerability affects all versions prior to 4.0.0, which includes a fix that automatically releases memory when cached items expire. The fix is available in version 4.0.0 and later.
Affected products
- sindresorhus mem <4.0.0
Timeline
- 2018-01-17: disclosed
- 2019-07-05: patched: Fix released in version 4.0.0
- 2019-07-05: advisory