WS-2018-0075

"Versions of concat-stream before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into write.Versions 1.3.0 are not affected due to not using unguarded Buffer constructor."...