Memory Exposure in concat-stream
Summary
GHSA-g74r-ffvr-5q9f: Memory Exposure in concat-stream. Affects concat-stream across 3 version ranges.
>= 1.3.0, < 1.3.2
>= 1.4.0, < 1.4.11
>= 1.5.0, < 1.5.2
Fixed in 1.3.2, 1.4.11 or 1.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The concat-stream package is an npm package that provides a writable stream that concatenates all data written to it. It is commonly used in Node.js applications to collect data from multiple sources and combine them into a single stream. The package is vulnerable to memory exposure if user-provided input is passed into the write() function. This vulnerability can lead to the exposure of sensitive information stored in memory.
Vulnerability Detail
The vulnerability in concat-stream arises from versions before 1.5.2 not properly handling user-provided input passed into the write() function. This can result in memory exposure, allowing an attacker to access sensitive information stored in memory. Versions prior to 1.3.0 are not affected due to not using the unguarded Buffer constructor. The vulnerability has a moderate severity rating and is classified under CWE-200.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.3.0, < 1.3.21.3.2npm install concat-stream@1.3.2 -
>= 1.4.0, < 1.4.111.4.11npm install concat-stream@1.4.11 -
>= 1.5.0, < 1.5.21.5.2npm install concat-stream@1.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not feasible, a workaround for this vulnerability is to validate and sanitize user input before passing it to the write() function. This can be done by checking the type of the input and ensuring it is not a number. Here is an example of how to implement this workaround in JavaScript:
const concat = require('concat-stream');
const writableStream = concat({ encoding: 'string' }, function(data) {
// Validate and sanitize the data
if (typeof data !== 'number') {
// Process the data
}
});
Conclusion
The concat-stream package is vulnerable to memory exposure if user-provided input is not properly handled. It is important to update to the recommended versions or implement the provided workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concat-stream →
FAQ
concat-stream is an npm package that provides a writable stream for concatenating data. It is commonly used in Node.js applications to combine data from multiple sources into a single stream.
The vulnerability allows an attacker to access sensitive information stored in memory. This can lead to the exposure of confidential data and potential security breaches.
Versions before 1.5.2 are vulnerable to this memory exposure issue. Versions prior to 1.3.0 are not affected due to not using the unguarded Buffer constructor.
To fix the vulnerability, update to version 1.5.2, 1.4.11, 1.3.2, or later. If updating is not possible, ensure that user-provided input passed into the write() function is not a number.
Yes, if updating the package is not feasible, you can validate and sanitize user input before passing it to the write() function. Ensure that the input is not a number to mitigate the vulnerability.
