CVE-2018-3767
Denial of Service in memjs
memjs versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
memjs versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage.
- Record
CVE-2018-3767- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
memjs versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage.
- Record
CVE-2018-3767- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2018-0585 No score
memjs versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage.
- Record
EUVD-2018-0585- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cx8m-8xmx-q8v3
Denial of Service in memjs
Versions of memjs prior to 1.2.2 are vulnerable to Denial of Service (DoS). The package fails to sanitize the value option passed to the Buffer constructor, which may allow attackers to pass large values exhausting system resources.
Recommendation
Upgrade to version 1.2.2 or later.
- Record
GHSA-cx8m-8xmx-q8v3- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-cx8m-8xmx-q8v3
Denial of Service in memjs
Versions of memjs prior to 1.2.2 are vulnerable to Denial of Service (DoS). The package fails to sanitize the value option passed to the Buffer constructor, which may allow attackers to pass large values exhausting system resources.
Recommendation
Upgrade to version 1.2.2 or later.
- Record
GHSA-cx8m-8xmx-q8v3- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
memjsnpm |
through 1.2.0 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-3767 is a critical vulnerability (CVSS 9.1) in Https://github.com/memcachier Memjs, published July 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. No source names a fixed version.