NPM Vulnerability Report

## NPM Vulnerability Report - Tuesday, October 1st, 2024
NPM packages have been checked for vulnerabilities using npm audit.

![HIGHEST_SEVERITY]


[HIGHEST_SEVERITY]: https://img.shields.io/badge/highest_severity-high-9e3302?style=for-the-badge 


⚠️ - 2 `MODERATE` severity vulnerabilities.
⚠️ - 3 `HIGH` severity vulnerabilities.

 



---
![body-parser_header]



**Severity**: `high`
**Vulnerable Range**: `<1.20.3`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: body-parser vulnerable to denial of service when url encoding is enabled.

**Severity**: `high`
**Vulnerable Range**: `<1.20.3`
**CVSS Score**: `7.5 / 10`
**Weaknesses**: `CWE-405`

[GitHub Advisory](https://github.com/advisories/GHSA-qwcr-r2fm-qrc7) 


 


</details>


**Latest Available Version**: `1.20.3`

This dependency has a `fix available`, but `body-parser` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.


</details>


[body-parser_header]: https://img.shields.io/badge/body_parser-9e3302?style=for-the-badge 


 



---
![express_header]



**Severity**: `high`
**Vulnerable Range**: `<=4.19.2 || 5.0.0-alpha.1 - 5.0.0-beta.3`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: express vulnerable to XSS via response.redirect().

**Severity**: `moderate`
**Vulnerable Range**: `<4.20.0`
**CVSS Score**: `5 / 10`
**Weaknesses**: `CWE-79`

[GitHub Advisory](https://github.com/advisories/GHSA-qw6h-vgh9-j6wx) 

Via `body-parser`

Via `path-to-regexp`

Via `send`

Via `serve-static`


 


</details>


**Latest Available Version**: `4.21.0`

This dependency has a `fix available`, and is a `direct dependency` in your package.json. 
See affected dependencies below:

Update `express` to `4.21.0`.

[express_header]: https://img.shields.io/badge/express-9e3302?style=for-the-badge 


 



---
![path-to-regexp_header]



**Severity**: `high`
**Vulnerable Range**: `<0.1.10`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: path-to-regexp outputs backtracking regular expressions.

**Severity**: `high`
**Vulnerable Range**: `<0.1.10`
**CVSS Score**: `7.5 / 10`
**Weaknesses**: `CWE-1333`

[GitHub Advisory](https://github.com/advisories/GHSA-9wv6-86v2-598j) 


 


</details>


**Latest Available Version**: `8.2.0`

This dependency has a `fix available`, but `path-to-regexp` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.


</details>


[path-to-regexp_header]: https://img.shields.io/badge/path_to_regexp-9e3302?style=for-the-badge 


 



---
![send_header]



**Severity**: `moderate`
**Vulnerable Range**: `<0.19.0`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: send vulnerable to template injection that can lead to XSS.

**Severity**: `moderate`
**Vulnerable Range**: `<0.19.0`
**CVSS Score**: `5 / 10`
**Weaknesses**: `CWE-79`

[GitHub Advisory](https://github.com/advisories/GHSA-m6fv-jmcg-4jfg) 


 


</details>


**Latest Available Version**: `0.19.0`

This dependency has a `fix available`, but `send` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.


- Direct dependency `semver` does NOT have a fix available.


- Direct dependency `tslib` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `tslib` available.


Update from version `2.6.2` to `2.7.0`.


</details>


[send_header]: https://img.shields.io/badge/send-f5c60c?style=for-the-badge 


 



---
![serve-static_header]



**Severity**: `moderate`
**Vulnerable Range**: `<=1.16.0`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: serve-static vulnerable to template injection that can lead to XSS.

**Severity**: `moderate`
**Vulnerable Range**: `<1.16.0`
**CVSS Score**: `5 / 10`
**Weaknesses**: `CWE-79`

[GitHub Advisory](https://github.com/advisories/GHSA-cm22-4g7w-348p) 

Via `send`


 


</details>


**Latest Available Version**: `1.16.2`

This dependency has a `fix available`, but `serve-static` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.


</details>


[serve-static_header]: https://img.shields.io/badge/serve_static-f5c60c?style=for-the-badge

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

NPM Vulnerability Report #45

NPM Vulnerability Report - Tuesday, October 1st, 2024

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

NPM Vulnerability Report #45

Description

NPM Vulnerability Report - Tuesday, October 1st, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions