A flaw was found in base64url. An Uninitialized Memory Exposure in pad-string.ts file allows an attacker to extract sensitive data from uninitialized memory or may cause a Denial of Service (DoS) by passing in a large number, in setups where typed user input can be passed (e.g. from JSON).On Node.js 4.x and below (4.x is still supported), this exposes uninitialized memory, which could contain sensitive data. This can be also used to cause a DoS by consuming the memory when large numbers are passed on input.


References:
https://snyk.io/vuln/npm:base64url:20180511
https://hackerone.com/reports/321687

Patch:
https://github.com/brianloveswords/base64url/commit/4355cb294123e86171daa9389f7afe6d2b2b9dae