Rule Definition
Versions 9.7.0 and later are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. This rule has been listed as CVE-2018-7164 in the CVE registry. All versions before Node.js 9.11.2 and 10.4.1 are vulnerable.

Remediation
Update the Node.js library.

Violation Code Sample

import * as net from 'net';

const client = net.createConnection({ port: 8124 }, () => {
  // 'connect' listener
  console.log('connected to server!');
  client.write('world!\r\n');
});

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7164