Ai

Mem0 Node SDK v3.0.6 Patches High-Severity Vulnerabilities

Mem0 Node SDK v3.0.6 Patches High-Severity Vulnerabilities

Mem0 has released version 3.0.6 of its Node SDK, addressing several high-severity security vulnerabilities that could lead to credential theft, man-in-the-middle attacks, or denial of service. This isn't a feature drop — it's a security-critical maintenance release that all users should prioritize.

What Changed

The primary action was bumping the axios dependency from an unspecified older version to ^1.16.0. This remediates a series of prototype-pollution CVEs that could allow attackers to inject malicious properties into objects. But the team didn't stop there. They also pinned transitive dependencies using pnpm overrides to block known vulnerabilities in jws (CVE-2025-65945), langsmith (CVE-2026-45134), tar-fs (CVE-2025-48387 and CVE-2025-59343), picomatch (CVE-2026-33671), minimatch (three CVEs for different version ranges), and path-to-regexp (^8.4).

Each pinned version was chosen to close specific exploits. For example, tar-fs at ^2.1.4 prevents arbitrary file overwrite during archive extraction. And jws at 4.0.1 fixes a signature bypass issue that could compromise JWT verification.

Why It Matters

These are not hypothetical risks. Prototype pollution in axios, combined with insecure transitive dependencies, creates a real attack surface for any Node app using Mem0's SDK. A compromised langsmith could leak LangChain traces; a vulnerable path-to-regexp could enable regex-based ReDoS. For teams building AI agents or memory systems on Mem0, this update closes multiple backdoors.

What's notable is the proactive pinning. Most projects just bump the direct dependency and call it done. Mem0 went deeper, locking down the entire dependency tree. That's the kind of supply-chain hygiene enterprises need — especially when their AI infrastructure depends on Node SDKs.

One downside: strong pinning can lead to version conflicts if you use other packages that depend on different ranges. But given the severity of the CVEs, it's a trade-off worth making. If you're on an earlier version, upgrade to 3.0.6 now. Run your full test suite — this is a patch, not a breaking change, but dependency swaps can surface edge cases.

Official Source: https://github.com/mem0ai/mem0/releases/tag/ts-v3.0.6