CVE-2018-3767: Denial of Service in memjs
9.1
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.60347%
CWE
Published
10/10/2018
Updated
9/12/2023
KEV Status
No
Technology
JavaScript
Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
memjs | npm | <= 1.2.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from unsafe Buffer initialization in memjs's value handling. The advisory explicitly states the root cause is improper sanitization of the 'value' parameter passed to the Buffer constructor. In Node.js, new Buffer(value)
with a numeric input creates a buffer of that size. The Client.prototype.set
method is the primary entry point for storing values in memjs, making it the logical location where user-controlled values would be converted to buffers. This matches the CWE-400 (Uncontrolled Resource Consumption) pattern described in the advisory.