Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update deps (fast-xml-parser vuln) #15

Open
fauxbytes opened this issue Aug 20, 2024 · 1 comment
Open

update deps (fast-xml-parser vuln) #15

fauxbytes opened this issue Aug 20, 2024 · 1 comment

Comments

@fauxbytes
Copy link
Contributor

$ git log -1 --oneline
2aa0d8e (HEAD -> main, tag: v1.3.1, upstream/main, origin/main, origin/HEAD) 7:add support for NestJS 10 (#14)
$ npm audit
# npm audit report

braces  <3.0.3
Severity: high
Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
fix available via `npm audit fix`
node_modules/braces

express  <4.19.2
Severity: moderate
Express.js Open Redirect in malformed URLs - https://github.com/advisories/GHSA-rv95-896h-c2vc
fix available via `npm audit fix`
node_modules/express
  @nestjs/platform-express  <=10.3.5
  Depends on vulnerable versions of express
  node_modules/@nestjs/platform-express

fast-xml-parser  <4.4.1
Severity: high
fast-xml-parser vulnerable to ReDOS at currency parsing - https://github.com/advisories/GHSA-mpg4-rc92-vx8v
fix available via `npm audit fix`
node_modules/fast-xml-parser
  @aws-sdk/client-sts  <=3.186.3 || 3.188.0 - 3.525.0
  Depends on vulnerable versions of fast-xml-parser
  node_modules/@aws-sdk/client-sts
    @aws-sdk/client-ssm  3.12.0 - 3.525.0
    Depends on vulnerable versions of @aws-sdk/client-sts
    node_modules/@aws-sdk/client-ssm

6 vulnerabilities (2 moderate, 4 high)

To address all issues, run:
  npm audit fix
@fauxbytes
Copy link
Contributor Author

#16

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant