{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "put"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:43:51Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "All versions of `put` are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This vulnerability only affects versions of Node.js \u003c=6.x.\n\n\n## Recommendation\n\nUpgrade your Node.js version or consider using an alternative package.",
  "id": "GHSA-v6gv-fg46-h89j",
  "modified": "2020-08-31T18:43:51Z",
  "published": "2020-09-03T16:48:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/321702"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/1007"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Sensitive Data Exposure in put"
}