inflight - transient dependency introduced memory leak

[jorgemlopez]

👮 Responsible Disclosure

Do not open issues that might have security implications. It is critical that security related issues
are reported privately so we have time to address them before they become public knowledge.

Please read our SECURITY.md before reporting a vulnerability.

Individuals who find potential vulnerabilities in a package are invited
to complete a vulnerability report on the dedicated HackerOne organization:

https://hackerone.com/fastify

Vulnerabilities can also be reported by emailing to Fastify core members:

• Matteo Collina

Summary

This package uses a version of node-glob which uses as a dependency inflight. The version of inflight uses has a memory leak. See issue: isaacs/inflight#18.

Inflight seems to have been abandoned and it is not longer a dependency of node-glob version 9 and above. However @nestjs/static is not compatible with node-glob v9+.

Proposed Resolution

To fix this, you will need to use fast-glob or upgrade the dependency to glob v9 where the dependency on inflight has been removed.

[jorgemlopez]

@mabreuortega for visibility

[gurgunday]

Version 9 only supports node 16+ and (AFAIK) it contains a blue-oak–licensed dependency

Edit: not sure if it's really a leak

[Uzlopak]

Reading the sec vuln report it seems to be just non issue.

Memory Leak: inflight is vulnerable to a Memory Leak. The vulnerability is due to lack of restrictions on how many callbacks the library can concurrently support, which can result in a NodeJS out of heap memory crash.

[jorgemlopez]

Snyk is reporting it as a High Risk issue based on:

https://cwe.mitre.org/data/definitions/772.html

https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

This is all due to the original issue reported: isaacs/inflight#5

[jorgemlopez]

Here is the closed issue in node-glob: isaacs/node-glob#435

[epignosisx]

Leaving this here for inspiration:

mcollina/help-me#19

[mcollina]

If you land yourself here, don't worry: this module does not suffer from a memory leak, as the call to glob is used only once during startup.

[mcollina]

This is fixed in @fastify/static v7