Out-of-bounds Read in concat-with-sourcemaps
Summary
GHSA-2xv3-h762-ccxv: Out-of-bounds Read in concat-with-sourcemaps. Affects concat-with-sourcemaps versions >= 1.0.0, < 1.0.6. Fixed in 1.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The concat-with-sourcemaps package is an npm package used for concatenating files and generating source maps. It allows developers to combine multiple files into a single file while preserving the original source map information. This package is commonly used in JavaScript projects to optimize and bundle code.
Vulnerability Detail
Versions of concat-with-sourcemaps before 1.0.6 have a vulnerability that leads to out-of-bounds read. When a number is passed as a separator, uninitialized Buffers are allocated. This can result in reading data from memory locations outside the intended boundaries, potentially leading to information disclosure or crashes.
How To Fix
Minimum fixed version
1.0.6
This is the first release that contains the fix.
npm install concat-with-sourcemaps@1.0.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The concat-with-sourcemaps package before version 1.0.6 has a vulnerability that can lead to out-of-bounds read. It is recommended to update to version 1.0.6 or later to fix this issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for concat-with-sourcemaps →
FAQ
The concat-with-sourcemaps package is used for concatenating files and generating source maps in JavaScript projects.
This vulnerability can potentially lead to information disclosure or crashes due to out-of-bounds read.
To fix this vulnerability, update the concat-with-sourcemaps package to version 1.0.6 or later.
No, only versions before 1.0.6 are affected. Version 1.0.6 and later include the necessary fixes.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-2xv3-h762-ccxv/GHSA-2xv3-h762-ccxv.json
