Homepage
About Snyk

concat-stream@1.4.8 vulnerabilities

writable stream that concatenates strings or binary data and calls a callback with the result

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the concat-stream package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Uninitialized Memory Exposure

concat-stream is writable stream that concatenates strings or binary data and calls a callback with the result. Affected versions of the package are vulnerable to Uninitialized Memory Exposure.

A possible memory disclosure vulnerability exists when a value of type number is provided to the stringConcat() method and results in concatenation of uninitialized memory to the stream collection.

This is a result of unobstructed use of the Buffer constructor, whose insecure default constructor increases the odds of memory leakage.

How to fix Uninitialized Memory Exposure?

Upgrade concat-stream to version 1.5.2 or higher. Note This is vulnerable only for Node <=4

<1.3.2 >=1.4.0 <1.4.11 >=1.5.0 <1.5.2
Go back to all versions of this package