Executive brief
The mem library is a Node.js memoization utility used to cache function results for performance. Versions before 4.0.0 contain a bug where cached values are never removed after their expiration time (maxAge), causing a memory leak. An attacker who can trigger the vulnerable application to log or cache data repeatedly could exhaust system memory and make the service unavailable.
Technical details
The vulnerability is a memory leak (CWE-400) in the mem memoization library. The root cause is that the cache fails to delete expired entries even after they pass their maxAge threshold, allowing stale cached results to accumulate indefinitely in memory. The attack vector is local with high complexity, requiring the attacker to be able to cause the application to repeatedly invoke cached functions. An attacker who can abuse application logging or trigger repeated function calls can exhaust system memory, leading to denial of service. The vulnerability affects all versions prior to 4.0.0, which includes a fix that automatically releases memory when cached items expire. The fix is available in version 4.0.0 and later.
Affected products
- sindresorhus mem <4.0.0
Timeline
- 2018-01-17: disclosed
- 2019-07-05: patched: Fix released in version 4.0.0
- 2019-07-05: advisory