nodejs-mem before version 4.0.0 has a memory leak due to old results not being removed from the cache despite reaching maxAge. Exploitation of this can lead to exhaustion of memory and subsequent denial of service. Upstream Issue: https://github.com/sindresorhus/mem/issues/14 Upstream Patch: https://github.com/sindresorhus/mem/commit/da4e4398cb27b602de3bd55f746efa9b4a31702b
Snyk advisory: https://snyk.io/vuln/npm:mem:20180117
The mem package is used by / bundled with npm (via libnpx -> yargs -> os-locale -> mem). The os-locale package does not specify maxAge in its uses of maxAge, keeping the the cached values in memory forever. Hence this bug is not relevant to the use of mem in npm.