CVE-2018-3767 — `memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage

CRITICAL

`memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage

Published Jul 5, 2018

9.1

CRITICAL

CVSS 3.0

EPSS 1.45%

`memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Memjs

n/a

Version	Status	Constraints
Not fixed	affected	-

Ecosystem	Package	Introduced	Fixed
npm	memjs	0	not fixed

No remediation recorded yet.

1.45% 0.01452

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01452

2021–2026

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.45% (0.01452)	72.46th	v5 (v2026.06.15)
Jun 15, 2026	1.45% (0.01452)	69.90th	v5 (v2026.06.15)
Jul 20, 2024	0.39% (0.00390)	73.54th	v3 (v2023.03.01)
Feb 8, 2024	0.39% (0.00390)	72.59th	v3 (v2023.03.01)
Mar 7, 2023	0.39% (0.00390)	69.10th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Sep 10, 2022	0.89% (0.00885)	26.24th	v2 (v2022.01.01)
Apr 1, 2022	0.89% (0.00885)	24.24th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00885)	10.50th	v2 (v2022.01.01)
Feb 3, 2022	0.42% (0.00416)	10.04th	v1
Jan 6, 2022	0.42% (0.00416)	9.79th	v1
Sep 1, 2021	0.42% (0.00416)	25.53th	v1
Apr 14, 2021	0.42% (0.00416)	0.00th	v1

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

Link	Providers	Tags
https://github.com/advisories/GHSA-cx8m-8xmx-q8v3		Advisory
https://hackerone.com/reports/319809		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-3767
https://www.npmjs.com/advisories/970