async-sema

hands (or ) straight to without any range or finiteness check: Node clamps any delay above (24.9 days), and also , and values `readme.md:87pauseFnRateLimitSemapauseFnRateLimit` user has no way to apply the documented mitigation. Mentioning it in case you consider that worth a line in the README or an extra option.

Hello async-sema maintainers, I have discovered a security vulnerability in this package (specifically, a concurrency limit bypass and a memory leak leading to potential DoS). I have already sent a detailed vulnerability report, including the full Proof of Concept and recommended fixes, to responsible.disclosure@vercel.com in accordance with Vercel's open-source security policy. However, the automated HackerOne submission link provided in their auto-reply is currently blocking my account due to "Trial Report" limits, and submitting as a guest would prevent me from receiving proper credit. To adhere to responsible disclosure practices, I have not included any technical details or exploit code in this public issue. Could a maintainer please: Check the responsible.disclosure@vercel.com inbox for my report (sent by sathyacierto), OR Create a private GitHub Security Advisory for this repository and invite me (@sathyacierto) to collaborate so we can discuss the fix securely? Thank you for your time and for maintaining this package. Best regards, Sathya Cierto HackerOne: https://hackerone.com/sathyacierto?type=user

Summary fixes a few README typos in the semaphore option docs adds a regression test for the existing validation that and must be provided together Validation