inflight - transient dependency introduced memory leak about fastify-static HOT 8 CLOSED

If you land yourself here, don't worry: this module does not suffer from a memory leak, as the call to glob is used only once during startup.

from fastify-static.

@mabreuortega for visibility

from fastify-static.

This is fixed in @fastify/static v7

from fastify-static.

Version 9 only supports node 16+ and (AFAIK) it contains a blue-oak–licensed dependency

Edit: not sure if it's really a leak

from fastify-static.

Reading the sec vuln report it seems to be just non issue.

Memory Leak: inflight is vulnerable to a Memory Leak. The vulnerability is due to lack of restrictions on how many callbacks the library can concurrently support, which can result in a NodeJS out of heap memory crash.

from fastify-static.

Snyk is reporting it as a High Risk issue based on:

https://cwe.mitre.org/data/definitions/772.html

https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

This is all due to the original issue reported: isaacs/inflight#5

from fastify-static.

Here is the closed issue in node-glob: isaacs/node-glob#435

from fastify-static.

Leaving this here for inspiration:

mcollina/help-me#19

from fastify-static.