Homepage

inflight@1.0.6 vulnerabilities

Add callbacks to requests in flight to avoid async duplication

  • latest version

    1.0.6

  • first published

    11 years ago

  • latest version published

    8 years ago

  • deprecated

    Package is deprecated

  • licenses detected

  • View inflight package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the inflight package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Missing Release of Resource after Effective Lifetime

    Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres function due to improperly deleting keys from the reqs object after execution of callbacks. This behavior causes the keys to remain in the reqs object, which leads to resource exhaustion.

    Exploiting this vulnerability results in crashing the node process or in the application crash.

    Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.

    To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.

    How to fix Missing Release of Resource after Effective Lifetime?

    There is no fixed version for inflight.

    *
    Go back to all versions of this package