{"id":"GHSA-4xcv-9jjx-gfj3","aliases":["CLSA-2026-1771546202","CLSA-2026-1793867525"],"status":"published","title":"Denial of Service in mem","description":"Versions of `mem` prior to 4.0.0 are vulnerable to Denial of Service (DoS).  The package fails to remove old values from the cache even after a value passes its `maxAge` property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.\n\n\n## Recommendation\n\nUpgrade to version 4.0.0 or later.","severity":{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2019-07-05T21:07:58Z","modified":"2026-11-05T13:15:12Z","fixes":[{"ecosystem":"npm","package":"mem","fixed_in":["4.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"mem","fixed_in":["1.1.0-tuxcare.2","1.1.0-tuxcare.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-tuxcare.0"},{"fixed":"1.1.0-tuxcare.2"}]}],"versions":["1.1.0","1.1.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-tuxcare.0"},{"fixed":"1.1.0-tuxcare.3"}]}],"versions":["1.1.0","1.1.0-tuxcare.1","1.1.0-tuxcare.2"]},{"source":"osv","ecosystem":"npm","package":"mem","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.0.0"}]}]}],"references":[{"url":"https://github.com/sindresorhus/mem/commit/da4e4398cb27b602de3bd55f746efa9b4a31702b","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1623744","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1084","tags":["web"]},{"url":"https://snyk.io/vuln/npm:mem:20180117","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4xcv-9jjx-gfj3"}],"sources":{"ghsa":[{"id":"GHSA-4xcv-9jjx-gfj3","title":"Denial of Service in mem","description":"Versions of `mem` prior to 4.0.0 are vulnerable to Denial of Service (DoS).  The package fails to remove old values from the cache even after a value passes its `maxAge` property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.\n\n\n## Recommendation\n\nUpgrade to version 4.0.0 or later.","status":"published","published":"2019-07-05T21:07:58Z","modified":"2023-01-09T05:01:45Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"osv":[{"id":"GHSA-4xcv-9jjx-gfj3","title":"Denial of Service in mem","description":"Versions of `mem` prior to 4.0.0 are vulnerable to Denial of Service (DoS).  The package fails to remove old values from the cache even after a value passes its `maxAge` property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.\n\n\n## Recommendation\n\nUpgrade to version 4.0.0 or later.","status":"published","published":"2019-07-05T21:07:58Z","modified":"2021-08-17T15:44:45Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"CLSA-2026-1771546202","title":"TuxCare security update for mem (1 CVE)","description":"TuxCare rebuilt mem to address 1 CVE. Fixed in 1.1.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:47:46.405853208Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1793867525","title":"TuxCare security update for mem (1 CVE)","description":"TuxCare rebuilt mem to address 1 CVE. Fixed in 1.1.0-tuxcare.3.","status":"published","published":"2026-11-05T09:32:06Z","modified":"2026-11-05T13:15:12.595528248Z","updated_at":"2026-11-05T13:30:00.949926Z"}]}}