All versions of put are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This vulnerability only affects versions of Node.js <=6.x.

Recommendation

Upgrade your Node.js version or consider using an alternative package.

References

• https://hackerone.com/reports/321702
• https://www.npmjs.com/advisories/1007