GHSA-g74r-ffvr-5q9f
Memory Exposure in concat-stream
Versions of concat-stream before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into write()
Versions <1.3.0 are not affected due to not using unguarded Buffer constructor.
Recommendation
Update to version 1.5.2, 1.4.11, 1.3.2 or later.
If you are unable to update make sure user provided input into the write() function is not a number.
What each source reports
GitHub AdvisoriesNo score
Memory Exposure in concat-stream
Versions of concat-stream before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into write()
Versions <1.3.0 are not affected due to not using unguarded Buffer constructor.
Recommendation
Update to version 1.5.2, 1.4.11, 1.3.2 or later.
If you are unable to update make sure user provided input into the write() function is not a number.
- Record
GHSA-g74r-ffvr-5q9f- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVCLSA-2026-1772669617No score
TuxCare security update for concat-stream (1 CVE)
TuxCare rebuilt concat-stream to address 1 CVE. Fixed in 1.5.0-tuxcare.1.
- Record
CLSA-2026-1772669617- Updated
- 2026-11-02
OSVCLSA-2026-1773793046No score
TuxCare security update for concat-stream (1 CVE)
TuxCare rebuilt concat-stream to address 1 CVE. Fixed in 1.4.8-tuxcare.1.
- Record
CLSA-2026-1773793046- Updated
- 2026-11-02
OSVCLSA-2026-1780534261No score
TuxCare security update for concat-stream (1 CVE)
TuxCare rebuilt concat-stream to address 1 CVE. Fixed in 1.4.10-tuxcare.1.
- Record
CLSA-2026-1780534261- Updated
- 2026-11-02
OSVCLSA-2026-1792163363No score
TuxCare security update for concat-stream (1 CVE)
TuxCare rebuilt concat-stream to address 1 CVE. Fixed in 1.5.1-tuxcare.1.
- Record
CLSA-2026-1792163363- Updated
- 2026-11-02
OSVNo score
Memory Exposure in concat-stream
Versions of concat-stream before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into write()
Versions <1.3.0 are not affected due to not using unguarded Buffer constructor.
Recommendation
Update to version 1.5.2, 1.4.11, 1.3.2 or later.
If you are unable to update make sure user provided input into the write() function is not a number.
- Record
GHSA-g74r-ffvr-5q9f- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
concat-streamnpm | 1.5.0 up to 1.5.2 | 1.5.2 |
concat-streamnpm | 1.4.0 up to 1.4.11 | 1.4.11 |
concat-streamnpm | 1.3.0 up to 1.3.2 | 1.3.2 |
concat-streamTuxCare:npm | 1.5.0-tuxcare.0 up to 1.5.0-tuxcare.1, plus listed versions 1.5.0 | 1.5.0-tuxcare.1 |
concat-streamTuxCare:npm | 1.4.8-tuxcare.0 up to 1.4.8-tuxcare.1, plus listed versions 1.4.8 | 1.4.8-tuxcare.1 |
concat-streamTuxCare:npm | 1.4.10-tuxcare.0 up to 1.4.10-tuxcare.1, plus listed versions 1.4.10 | 1.4.10-tuxcare.1 |
concat-streamTuxCare:npm | 1.5.1-tuxcare.0 up to 1.5.1-tuxcare.1, plus listed versions 1.5.1 | 1.5.1-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-g74r-ffvr-5q9f is a vulnerability with no CVSS score yet in concat-stream, published June 3, 2019. No source lists public exploit code. Fixed in concat-stream 1.5.2.