NestJS, Hasura, Postgres, React, RefineJS, Kubernetes, FusionAuth
![renovate[bot] avatar](https://avatars.githubusercontent.com/in/2740?v=4 "renovate[bot]")
![imgbot[bot] avatar](https://avatars.githubusercontent.com/in/4706?v=4 "imgbot[bot]")
Vulnerable Library - eslint-config-custom-0.0.0.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in (eslint-config-custom version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2022-46175 |  High |
8.8 | json5-1.0.1.tgz | Transitive | N/A* | ❌ |
| CVE-2023-26115 | High |
7.5 | word-wrap-1.2.3.tgz | Transitive | N/A* | ❌ |
| CVE-2022-25883 | High |
7.5 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2022-46175JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
Publish Date: 2022-12-24
URL: CVE-2022-46175
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution: json5 - 2.2.2
Step up your Open Source Security Game with Mend here
CVE-2023-26115Wrap words to a specified length.
Library home page: https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
Publish Date: 2023-06-22
URL: CVE-2023-26115
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-j8xg-fqg3-53r7
Release Date: 2023-06-22
Fix Resolution: word-wrap - 1.2.4
Step up your Open Source Security Game with Mend here
CVE-2022-25883
The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-7.3.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Publish Date: 2023-06-21
URL: CVE-2022-25883
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-c2qf-rxjj-qqgw
Release Date: 2023-06-21
Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2
Step up your Open Source Security Game with Mend here
Vulnerable Library - react-pwa-2.0.2.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (react-pwa version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-45133 | High |
8.8 | traverse-7.21.4.tgz | Transitive | N/A* | ❌ |
| CVE-2022-38900 | High |
7.5 | decode-uri-component-0.2.0.tgz | Transitive | N/A* | ❌ |
| CVE-2023-26144 |  Medium |
5.3 | graphql-16.5.0.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-45133Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.21.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods. Known affected plugins are @babel/plugin-transform-runtime; @babel/preset-env when using its useBuiltIns option; and any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator. No other plugins under the @babel/ namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in @babel/[email protected] and @babel/[email protected]. Those who cannot upgrade @babel/traverse and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected @babel/traverse versions: @babel/plugin-transform-runtime v7.23.2, @babel/preset-env v7.23.2, @babel/helper-define-polyfill-provider v0.4.3, babel-plugin-polyfill-corejs2 v0.4.6, babel-plugin-polyfill-corejs3 v0.8.5, babel-plugin-polyfill-es-shims v0.10.0, babel-plugin-polyfill-regenerator v0.5.3.
Publish Date: 2023-10-12
URL: CVE-2023-45133
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-67hx-6x53-jw92
Release Date: 2023-10-12
Fix Resolution: @babel/traverse - 7.23.2
Step up your Open Source Security Game with Mend here
CVE-2022-38900A better decodeURIComponent
Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
Publish Date: 2022-11-28
URL: CVE-2022-38900
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-w573-4hg7-7wgq
Release Date: 2022-11-28
Fix Resolution: decode-uri-component - 0.2.1
Step up your Open Source Security Game with Mend here
CVE-2023-26144A Query Language and Runtime which can target any service.
Library home page: https://registry.npmjs.org/graphql/-/graphql-16.5.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.
Note: It was not proven that this vulnerability can crash the process.
Publish Date: 2023-09-20
URL: CVE-2023-26144
Base Score Metrics:
Type: Upgrade version
Release Date: 2023-09-20
Fix Resolution: graphql - 16.8.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - backend-0.0.1.tgzPath to dependency file: /package.json
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (backend version) | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2022-41919 |  High |
8.8 | fastify-4.9.2.tgz | Transitive | N/A* | ❌ |
| CVE-2022-39386 | High |
7.5 | websocket-6.0.1.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
CVE-2022-41919Fast and low overhead web framework, for Node.js
Library home page: https://registry.npmjs.org/fastify/-/fastify-4.9.2.tgz
Dependency Hierarchy:
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
Found in base branch: main
Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch() requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/json content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. This issue has been patched in version 4.10.2 and 3.29.4. As a workaround, implement Cross-Site Request Forgery protection using `@fastify/csrf'.
Publish Date: 2022-11-22
URL: CVE-2022-41919
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-3fjj-p79j-c9hh
Release Date: 2022-11-22
Fix Resolution: fastify - 3.29.4,4.10.2
Step up your Open Source Security Game with Mend here
CVE-2022-39386basic websocket support for fastify
Library home page: https://registry.npmjs.org/@fastify/websocket/-/websocket-6.0.1.tgz
Dependency Hierarchy:
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
Found in base branch: main
@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions.
Publish Date: 2022-11-08
URL: CVE-2022-39386
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-4pcg-wr6c-h9cq
Release Date: 2022-11-08
Fix Resolution: @fastify/websocket - 5.0.1,7.1.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - cronicle-0.0.1.tgz
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (cronicle version) | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2023-22467 | High |
7.5 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
CVE-2023-22467
Immutable date wrapper
Library home page: https://registry.npmjs.org/luxon/-/luxon-3.0.4.tgz
Dependency Hierarchy:
Immutable date wrapper
Library home page: https://registry.npmjs.org/luxon/-/luxon-1.28.0.tgz
Dependency Hierarchy:
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
Found in base branch: main
Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.
Publish Date: 2023-01-04
URL: CVE-2023-22467
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-3xq5-wjfh-ppjc
Release Date: 2023-01-04
Fix Resolution: luxon - 1.28.1,2.5.2,3.2.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - landing-site-1.0.0.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (landing-site version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-44270 | Medium |
5.3 | postcss-8.4.14.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-44270Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.14.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
Publish Date: 2023-09-29
URL: CVE-2023-44270
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-44270
Release Date: 2023-09-29
Fix Resolution: postcss - 8.4.31
Step up your Open Source Security Game with Mend here
Vulnerable Library - mantis-free-react-admin-template-1.0.0.tgz
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (mantis-free-react-admin-template version) | Remediation Available |
|---|---|---|---|---|---|---|
| CVE-2023-28154 |  Critical |
9.8 | webpack-5.74.0.tgz | Transitive | N/A* | ❌ |
| CVE-2022-46175 | High |
8.8 | json5-2.2.1.tgz | Transitive | N/A* | ❌ |
| CVE-2022-25927 | High |
7.5 | ua-parser-js-1.0.32.tgz | Transitive | N/A* | ❌ |
| CVE-2022-37603 | High |
7.5 | detected in multiple dependencies | Transitive | N/A* | ❌ |
| CVE-2022-3517 | High |
7.5 | minimatch-3.0.4.tgz | Transitive | N/A* | ❌ |
| CVE-2021-3803 | High |
7.5 | nth-check-1.0.2.tgz | Transitive | N/A* | ❌ |
| CVE-2023-26136 | Medium |
6.5 | tough-cookie-4.1.2.tgz | Transitive | N/A* | ❌ |
| CVE-2022-25883 | Medium |
5.3 | detected in multiple dependencies | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
CVE-2023-28154Packs CommonJs/AMD modules for the browser. Allows to split your codebase into multiple bundles, which can be loaded on demand. Support loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.
Library home page: https://registry.npmjs.org/webpack/-/webpack-5.74.0.tgz
Dependency Hierarchy:
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
Found in base branch: main
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
Publish Date: 2023-03-13
URL: CVE-2023-28154
Base Score Metrics:
Type: Upgrade version
Release Date: 2023-03-13
Fix Resolution: webpack - 5.76.0
Step up your Open Source Security Game with Mend here
CVE-2022-46175JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-2.2.1.tgz
Dependency Hierarchy:
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
Found in base branch: main
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
Publish Date: 2022-12-24
URL: CVE-2022-46175
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution: json5 - 2.2.2
Step up your Open Source Security Game with Mend here
CVE-2022-25927Detect Browser, Engine, OS, CPU, and Device type/model from User-Agent data. Supports browser & node.js environment
Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-1.0.32.tgz
Dependency Hierarchy:
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
Found in base branch: main
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
Publish Date: 2023-01-26
URL: CVE-2022-25927
Base Score Metrics:
Type: Upgrade version
Release Date: 2023-01-26
Fix Resolution: ua-parser-js - 0.7.33,1.0.33
Step up your Open Source Security Game with Mend here
CVE-2022-37603
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-3.2.0.tgz
Dependency Hierarchy:
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.3.tgz
Dependency Hierarchy:
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
Found in base branch: main
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
Publish Date: 2022-10-14
URL: CVE-2022-37603
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-3rfm-jhwj-7488
Release Date: 2022-10-14
Fix Resolution: loader-utils - 1.4.2,2.0.4,3.2.1
Step up your Open Source Security Game with Mend here
CVE-2022-3517a glob matcher in javascript
Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz
Dependency Hierarchy:
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
Found in base branch: main
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Publish Date: 2022-10-17
URL: CVE-2022-3517
Base Score Metrics:
Type: Upgrade version
Release Date: 2022-10-17
Fix Resolution: minimatch - 3.0.5
Step up your Open Source Security Game with Mend here
CVE-2021-3803performant nth-check parser & compiler
Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz
Dependency Hierarchy:
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
Found in base branch: main
nth-check is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3803
Base Score Metrics:
Type: Upgrade version
Release Date: 2021-09-17
Fix Resolution: nth-check - v2.0.1
Step up your Open Source Security Game with Mend here
CVE-2023-26136RFC6265 Cookies and Cookie Jar for node.js
Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.2.tgz
Dependency Hierarchy:
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
Found in base branch: main
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Publish Date: 2023-07-01
URL: CVE-2023-26136
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136
Release Date: 2023-07-01
Fix Resolution: tough-cookie - 4.1.3
Step up your Open Source Security Game with Mend here
CVE-2022-25883
The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-7.3.8.tgz
Dependency Hierarchy:
The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz
Dependency Hierarchy:
Found in HEAD commit: 1ce8553d0c78ec5c6b525e2a6bf546cd805085ce
Found in base branch: main
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Publish Date: 2023-06-21
URL: CVE-2022-25883
Base Score Metrics:
Type: Upgrade version
Release Date: 2023-06-21
Fix Resolution: semver - 7.5.2
Step up your Open Source Security Game with Mend here
Vulnerable Library - creator-panel-3.25.0.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (creator-panel version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-45133 | High |
8.8 | traverse-7.19.6.tgz | Transitive | N/A* | ❌ |
| CVE-2022-46175 | High |
8.8 | json5-2.2.1.tgz | Transitive | N/A* | ❌ |
| CVE-2024-4068 | High |
7.5 | braces-2.3.2.tgz | Transitive | N/A* | ❌ |
| CVE-2022-25883 | High |
7.5 | semver-5.7.1.tgz | Transitive | N/A* | ❌ |
| CVE-2022-21681 | High |
7.5 | marked-0.8.2.tgz | Transitive | N/A* | ❌ |
| CVE-2022-21680 | High |
7.5 | marked-0.8.2.tgz | Transitive | N/A* | ❌ |
| CVE-2024-28849 | Medium |
6.5 | follow-redirects-1.15.2.tgz | Transitive | N/A* | ❌ |
| CVE-2023-45857 | Medium |
6.5 | axios-0.26.1.tgz | Transitive | N/A* | ❌ |
| CVE-2023-26159 | Medium |
6.1 | follow-redirects-1.15.2.tgz | Transitive | N/A* | ❌ |
| WS-2020-0163 | Medium |
5.9 | marked-0.8.2.tgz | Transitive | N/A* | ❌ |
| CVE-2024-4067 | Medium |
5.3 | micromatch-3.1.10.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2023-45133The Babel Traverse module maintains the overall tree state, and is responsible for replacing, removing, and adding nodes
Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.19.6.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
Found in base branch: main
Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods. Known affected plugins are @babel/plugin-transform-runtime; @babel/preset-env when using its useBuiltIns option; and any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator. No other plugins under the @babel/ namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in @babel/[email protected] and @babel/[email protected]. Those who cannot upgrade @babel/traverse and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected @babel/traverse versions: @babel/plugin-transform-runtime v7.23.2, @babel/preset-env v7.23.2, @babel/helper-define-polyfill-provider v0.4.3, babel-plugin-polyfill-corejs2 v0.4.6, babel-plugin-polyfill-corejs3 v0.8.5, babel-plugin-polyfill-es-shims v0.10.0, babel-plugin-polyfill-regenerator v0.5.3.
Publish Date: 2023-10-12
URL: CVE-2023-45133
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-67hx-6x53-jw92
Release Date: 2023-10-12
Fix Resolution: @babel/traverse - 7.23.2
Step up your Open Source Security Game with Mend here
CVE-2022-46175JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-2.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
Found in base branch: main
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
Publish Date: 2022-12-24
URL: CVE-2022-46175
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution: json5 - 2.2.2
Step up your Open Source Security Game with Mend here
CVE-2024-4068Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
Library home page: https://registry.npmjs.org/braces/-/braces-2.3.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
Found in base branch: main
The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.
Publish Date: 2024-05-14
URL: CVE-2024-4068
Base Score Metrics:
Type: Upgrade version
Release Date: 2024-05-14
Fix Resolution: braces - 3.0.3
Step up your Open Source Security Game with Mend here
CVE-2022-25883The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
Found in base branch: main
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Publish Date: 2023-06-21
URL: CVE-2022-25883
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-c2qf-rxjj-qqgw
Release Date: 2023-06-21
Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2
Step up your Open Source Security Game with Mend here
CVE-2022-21681A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.8.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
Found in base branch: main
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Publish Date: 2022-01-14
URL: CVE-2022-21681
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-5v2h-r2cx-5xgj
Release Date: 2022-01-14
Fix Resolution: marked - 4.0.10
Step up your Open Source Security Game with Mend here
CVE-2022-21680A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.8.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
Found in base branch: main
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression block.def may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Publish Date: 2022-01-14
URL: CVE-2022-21680
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-rrrm-qjm4-v8hf
Release Date: 2022-01-14
Fix Resolution: marked - 4.0.10
Step up your Open Source Security Game with Mend here
CVE-2024-28849HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
Found in base branch: main
follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Publish Date: 2024-03-14
URL: CVE-2024-28849
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-cxjh-pqwp-8mfp
Release Date: 2024-03-14
Fix Resolution: follow-redirects - 1.15.6
Step up your Open Source Security Game with Mend here
CVE-2023-45857Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.26.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
Found in base branch: main
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
Publish Date: 2023-11-08
URL: CVE-2023-45857
Base Score Metrics:
Type: Upgrade version
Release Date: 2023-11-08
Fix Resolution: axios - 1.6.0
Step up your Open Source Security Game with Mend here
CVE-2023-26159HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
Found in base branch: main
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Publish Date: 2024-01-02
URL: CVE-2023-26159
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159
Release Date: 2024-01-02
Fix Resolution: follow-redirects - 1.15.4
Step up your Open Source Security Game with Mend here
WS-2020-0163A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.8.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
Found in base branch: main
marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.
Publish Date: 2020-07-02
URL: WS-2020-0163
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-07-02
Fix Resolution: marked - 1.1.1
Step up your Open Source Security Game with Mend here
CVE-2024-4067Glob matching for javascript/node.js. A drop-in replacement and faster alternative to minimatch and multimatch.
Library home page: https://registry.npmjs.org/micromatch/-/micromatch-3.1.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 6c8f2efdac17fd0023323d6e6531de794c250cf9
Found in base branch: main
The NPM package micromatch is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of micromatch should follow the fix recommendation as noted.
Publish Date: 2024-05-14
URL: CVE-2024-4067
Base Score Metrics:
Type: Upgrade version
Release Date: 2024-05-14
Fix Resolution: micromatch - 4.0.6
Step up your Open Source Security Game with Mend here
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
These updates are currently rate-limited. Click on a checkbox below to force their creation now.
@commitlint/cli, @commitlint/config-conventional)@graphql-codegen/cli, @graphql-codegen/introspection, @graphql-codegen/typescript, @graphql-codegen/typescript-operations)@types/jest, jest)@types/react, @types/react-dom, react, react-dom)@aws-sdk/client-s3, @aws-sdk/s3-request-presigner)@emotion/cache, @emotion/react, @emotion/server, @emotion/styled)@mui/icons-material, @mui/lab, @mui/material, @mui/system, @mui/utils)@nestjs/common, @nestjs/core, @nestjs/microservices, @nestjs/platform-fastify, @nestjs/schematics, @nestjs/terminus, @nestjs/testing)ra-data-json-server, react-admin)@typescript-eslint/eslint-plugin, @typescript-eslint/parser)@commitlint/cli, @commitlint/config-conventional)supertest, @types/supertest)@graphql-codegen/cli, @graphql-codegen/typescript-graphql-request)node, @types/node)@nestjs/common, @nestjs/core, @nestjs/microservices, @nestjs/platform-fastify, @nestjs/schematics, @nestjs/terminus, @nestjs/testing)@typescript-eslint/eslint-plugin, @typescript-eslint/parser)These updates have all been created already. Click a checkbox below to force a retry/rebase of any.
docker-compose.yml
hasura/graphql-engine v2.29.0redis 7-alpinefusionauth/docker-compose.yml
postgres 15-alpinefusionauth/fusionauth-app 1.46.0
.gitpod.Dockerfile
Dockerfile
node 16-alpine
.github/workflows/backport.yml
actions/checkout v3korthout/backport-action v1.github/workflows/ci.yml
actions/checkout v3arduino/setup-task v1pnpm/action-setup v2.2.4actions/setup-node v3tj-actions/branch-names v6andstor/file-existence-action v2dorny/test-reporter v1EndBug/add-and-commit v9trufflesecurity/trufflehog v3.6.7dorny/paths-filter v2.github/workflows/nuclei.yml
actions/checkout v2actions/upload-artifact v2github/codeql-action v2.github/workflows/rebase.yml
actions/checkout v3cirrus-actions/rebase 1.7.github/workflows/release_drafter.yml
release-drafter/release-drafter v5.github/workflows/reviewdog.yml
actions/checkout v3reviewdog/action-misspell v1reviewdog/action-hadolint v1yu-iskw/action-sqlfluff v3reviewdog/action-shellcheck v1.github/workflows/safe-space.yml
actions/checkout v3.github/workflows/sync.yml
actions/checkout v3tj-actions/branch-names v6tretuna/sync-branches 1.4.0.github/workflows/version.yml
actions/checkout v3tj-actions/changed-files v35codacy/git-version 2.7.1
apps/admin-panel/package.json
@apollo/client 3.6.9@emotion/react 11.9.3@emotion/styled 11.9.3@mui/icons-material 5.8.4@mui/lab 5.0.0-alpha.89@mui/material 5.8.7@mui/system 5.8.7@mui/utils 5.8.6envsafe 2.0.3graphql 16.5.0is-mobile 3.1.1notistack 2.0.8ra-data-hasura 0.5.3ra-data-json-server 4.3.0react 18.2.0react-admin 4.7.6react-dom 18.2.0react-error-boundary 3.1.4react-helmet-async 1.3.0react-hotkeys-hook 3.4.7react-router-dom 6.3.0recoil 0.7.7@graphql-codegen/cli 2.11.8@testing-library/react 13.3.0@types/node 17.0.45@types/react 18.0.28@types/react-dom 18.0.11@vitejs/plugin-react 1.3.2c8 7.12.0eslint 8.19.0jsdom 20.0.3optionator 0.9.3typescript 4.9.5vite 4.3.9vite-plugin-checker 0.4.9vite-plugin-pwa 0.12.3vite-tsconfig-paths 3.5.0vitest 0.17.1vitest-preview ^0.0.1workbox-window 6.5.4apps/creator-panel/package.json
@emotion/react ^11.10.6@emotion/styled ^11.10.6@mui/lab 5.0.0-alpha.127@mui/material ^5.12.1@refinedev/cli ^2.5.3@refinedev/core ^4.10.0@refinedev/hasura ^6.4.0@refinedev/mui ^4.10.3@refinedev/react-hook-form ^4.1.6@refinedev/react-router-v6 ^4.1.0@refinedev/react-table ^5.1.4@refinedev/simple-rest ^4.5.0@tanstack/react-table ^8.8.5react ^18.2.0react-dom ^18.2.0react-router-dom 6.10.0@types/react ^18.0.38@types/react-dom ^18.0.11@vitejs/plugin-react ^4.0.0typescript ^5.0.4vite ^4.3.1apps/landing-site/package.json
@emotion/cache 11.10.1@emotion/react 11.9.3@emotion/server 11.10.0@emotion/styled 11.9.3@mui/icons-material 5.8.4@mui/lab 5.0.0-alpha.89@mui/material 5.8.7@mui/system 5.8.7@mui/utils 5.8.6clsx 1.2.1next 12.2.4next-i18next 11.3.0next-language-detector 1.0.2react 18.2.0react-dom 18.2.0@types/node 17.0.45@types/react 18.0.28@types/react-dom 18.0.11http-server 14.1.1locize-cli 7.13.2typescript 4.9.5vitest 0.17.1apps/main_server/package.json
@aws-sdk/client-s3 3.267.0@aws-sdk/s3-request-presigner 3.267.0@fastify/cookie ^8.3.0@fastify/secure-session ^6.0.0@fusionauth/typescript-client ^1.46.0@golevelup/nestjs-common 1.4.5@golevelup/nestjs-discovery 3.0.1@golevelup/nestjs-graphql-request 0.1.16@golevelup/nestjs-hasura 3.0.4@golevelup/nestjs-modules ^0.6.1@liaoliaots/nestjs-redis ^9.0.5@nestjs-plugins/nestjs-nats-jetstream-transport ^1.3.12@nestjs/common 9.3.8@nestjs/config 2.3.1@nestjs/core 9.3.8@nestjs/event-emitter 1.4.2@nestjs/graphql 10.2.0@nestjs/jwt 10.0.2@nestjs/mapped-types *@nestjs/mercurius 10.2.0@nestjs/microservices 9.3.8@nestjs/platform-fastify 9.3.8@nestjs/terminus 9.2.0@squareboat/nest-mailman ^0.3.0@willsoto/nestjs-prometheus 5.2.1async-cache-dedupe ^1.9.0await-to-js ^3.0.0class-transformer ^0.5.1class-validator ^0.14.0dotenv 16.0.3envalid 7.3.1got 12.5.3graphql 16.6.0graphql-request 6.1.0ioredis 5.2.5jwks-rsa ^3.0.1kysely ^0.24.2lodash 4.17.21lodash-decorators 6.0.1mercurius 12.0.1nats ^2.12.1nestjs-cls 3.0.5nestjs-envalid ^2.2.0nestjs-kysely ^0.1.4nestjs-pino 3.1.2nestjs-s3 ^2.0.1openid-client ^5.4.0pg ^8.10.0pg-cursor ^2.9.0pino-http 8.3.3pino-sentry 0.14.0prom-client 14.1.1reflect-metadata 0.1.13rimraf 4.1.2rxjs 7.5.6zod 3.20.6@graphql-codegen/cli 4.0.1@graphql-codegen/introspection 4.0.0@graphql-codegen/typescript 4.0.0@graphql-codegen/typescript-graphql-request 5.0.0@graphql-codegen/typescript-operations 4.0.0@nestjs/cli 9.2.0@nestjs/schematics 9.0.4@nestjs/testing 9.3.8@types/jest 29.4.0@types/lodash 4.14.199@types/node 18.13.0@types/supertest 2.0.14eslint 8.34.0fastify ^4.13.0jest 29.4.3jest-cucumber ^3.0.1jest-extended ^3.2.3jest-junit ^15.0.0kysely-codegen ^0.10.0pino-pretty 9.2.0source-map-support 0.5.21supertest 6.3.3ts-jest 29.0.5ts-loader 9.4.2ts-node 10.9.1tsconfig-paths 4.1.2typescript 4.9.5apps/serverless/package.json
hono ^2.3.0@cloudflare/workers-types ^3.14.1@types/jest ^29.1.2esbuild ^0.18.0esbuild-jest ^0.5.0jest ^29.1.2jest-environment-miniflare ^2.10.0wrangler ^2.0.22package.json
dotenv-cli ^7.2.1@babel/plugin-transform-flow-strip-types 7.18.9@commitlint/cli 17.0.3@commitlint/config-conventional 17.0.3@faker-js/faker 7.5.0@trivago/prettier-plugin-sort-imports 3.3.1concurrently 8.2.0cross-env ^7.0.3docker-compose 0.23.19hasura-cli 2.28.0https-localhost 4.7.1husky 8.0.3is-port-reachable 3.1.0knip ^1.14.2lint-staged 13.1.2prettier 2.7.1rimraf 3.0.2tsc-alias 1.7.0turbo 1.10.14npm >=7.0.0node >=16.0.0pnpm 8.6.12packages/eslint-custom-config/package.json
@typescript-eslint/eslint-plugin ^5.9.0@typescript-eslint/parser ^5.9.0eslint-config-alloy ^4.4.0eslint-config-next ^12.0.8eslint-config-prettier ^8.3.0eslint-define-config ^1.5.1eslint-plugin-prettier ^4.0.0eslint-plugin-react ^7.28.0eslint-plugin-sonarjs ^0.13.0eslint-plugin-unused-imports ^2.0.0packages/tsconfig/package.json
packages/ui/package.json
@types/react 18.0.28@types/react-dom 18.0.11eslint 8.19.0react 17.0.2typescript 4.9.5
Vulnerable Library - main_server-0.0.1.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (main_server version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2024-4068 | High |
7.5 | braces-3.0.2.tgz | Transitive | N/A* | ❌ |
| CVE-2023-4316 | High |
7.5 | zod-3.20.6.tgz | Transitive | N/A* | ❌ |
| CVE-2023-34104 | High |
7.5 | fast-xml-parser-4.0.11.tgz | Transitive | N/A* | ❌ |
| CVE-2023-24807 | High |
7.5 | undici-5.11.0.tgz | Transitive | N/A* | ❌ |
| CVE-2022-37620 | High |
7.5 | html-minifier-4.0.0.tgz | Transitive | N/A* | ❌ |
| CVE-2024-31999 | High |
7.4 | secure-session-6.0.0.tgz | Transitive | N/A* | ❌ |
| CVE-2023-26920 | Medium |
6.5 | fast-xml-parser-4.0.11.tgz | Transitive | N/A* | ❌ |
| WS-2017-3770 | Medium |
6.1 | autolinker-0.28.1.tgz | Transitive | N/A* | ❌ |
| CVE-2023-23936 | Medium |
5.4 | undici-5.11.0.tgz | Transitive | N/A* | ❌ |
| WS-2020-0208 | Medium |
5.3 | highlight.js-9.18.5.tgz | Transitive | N/A* | ❌ |
| WS-2019-0540 | Medium |
5.3 | autolinker-0.28.1.tgz | Transitive | N/A* | ❌ |
| CVE-2024-4067 | Medium |
5.3 | micromatch-4.0.5.tgz | Transitive | N/A* | ❌ |
| CVE-2023-26144 | Medium |
5.3 | graphql-16.6.0.tgz | Transitive | N/A* | ❌ |
| CVE-2024-28176 | Medium |
4.9 | detected in multiple dependencies | Transitive | N/A* | ❌ |
| CVE-2024-30260 |  Low |
3.9 | undici-5.11.0.tgz | Transitive | N/A* | ❌ |
| CVE-2024-24758 | Low |
3.9 | undici-5.11.0.tgz | Transitive | N/A* | ❌ |
| CVE-2023-45143 | Low |
3.5 | undici-5.11.0.tgz | Transitive | N/A* | ❌ |
| CVE-2024-30261 | Low |
2.6 | undici-5.11.0.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2024-4068Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.
Publish Date: 2024-05-14
URL: CVE-2024-4068
Base Score Metrics:
Type: Upgrade version
Release Date: 2024-05-14
Fix Resolution: braces - 3.0.3
Step up your Open Source Security Game with Mend here
CVE-2023-4316Library home page: https://registry.npmjs.org/zod/-/zod-3.20.6.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.
Publish Date: 2023-09-28
URL: CVE-2023-4316
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-mvrp-3cvx-c325
Release Date: 2023-09-28
Fix Resolution: zod - 3.22.3
Step up your Open Source Security Game with Mend here
CVE-2023-34104Validate XML, Parse XML, Build XML without C/C++ based libraries
Library home page: https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.0.11.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the processEntities: false option.
Publish Date: 2023-06-06
URL: CVE-2023-34104
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-6w63-h3fj-q4vw
Release Date: 2023-06-06
Fix Resolution: fast-xml-parser - 4.2.4
Step up your Open Source Security Game with Mend here
CVE-2023-24807An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-5.11.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
Publish Date: 2023-02-16
URL: CVE-2023-24807
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-r6ch-mqf9-qc9w
Release Date: 2023-02-16
Fix Resolution: undici - 5.19.1
Step up your Open Source Security Game with Mend here
CVE-2022-37620Highly configurable, well-tested, JavaScript-based HTML minifier.
Library home page: https://registry.npmjs.org/html-minifier/-/html-minifier-4.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 via the candidate variable in htmlminifier.js.
Publish Date: 2022-10-31
URL: CVE-2022-37620
Base Score Metrics:
Step up your Open Source Security Game with Mend here
CVE-2024-31999Library home page: https://registry.npmjs.org/@fastify/secure-session/-/secure-session-6.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
@festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with a secret key and attach the ciphertext as a cookie value with the defined cookie name. After that, the session on the server side is destroyed. When an encrypted cookie with matching session name is provided with subsequent requests, it will decrypt the ciphertext to get the data. The plugin then creates a new session with the data in the ciphertext. Thus theoretically the web instance is still accessing the data from a server-side session, but technically that session is generated solely from a user provided cookie (which is assumed to be non-craftable because it is encrypted with a secret key not known to the user). The issue exists in the session removal process. In the delete function of the code, when the session is deleted, it is marked for deletion. However, if an attacker could gain access to the cookie, they could keep using it forever. Version 7.3.0 contains a patch for the issue. As a workaround, one may include a "last update" field in the session, and treat "old sessions" as expired.
Publish Date: 2024-04-10
URL: CVE-2024-31999
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-9wwp-q7wq-jx35
Release Date: 2024-04-10
Fix Resolution: @fastify/secure-session - 7.3.0
Step up your Open Source Security Game with Mend here
CVE-2023-26920Validate XML, Parse XML, Build XML without C/C++ based libraries
Library home page: https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.0.11.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
fast-xml-parser before 4.1.2 allows proto for Prototype Pollution.
Publish Date: 2023-12-12
URL: CVE-2023-26920
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-x3cc-x39p-42qx
Release Date: 2023-12-12
Fix Resolution: fast-xml-parser - 4.1.2
Step up your Open Source Security Game with Mend here
WS-2017-3770Utility to automatically link the URLs, email addresses, and Twitter handles in a given block of text/HTML
Library home page: https://registry.npmjs.org/autolinker/-/autolinker-0.28.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
Cross-site Scripting (XSS) vulnerability was found in autolinker before 3.14.0. User input passed to the innerHTML tags isn't sanitized.
Publish Date: 2017-02-15
URL: WS-2017-3770
Base Score Metrics:
Type: Upgrade version
Release Date: 2017-02-15
Fix Resolution: autolinker - 3.14.0
Step up your Open Source Security Game with Mend here
CVE-2023-23936An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-5.11.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.
Publish Date: 2023-02-16
URL: CVE-2023-23936
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-5r9g-qh6m-jxff
Release Date: 2023-02-16
Fix Resolution: undici - 5.19.1
Step up your Open Source Security Game with Mend here
WS-2020-0208Syntax highlighting with language autodetection.
Library home page: https://registry.npmjs.org/highlight.js/-/highlight.js-9.18.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable. On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service). This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable. If you are using highlightAuto to detect the language (and have any of these grammars registered) you are vulnerable.
Publish Date: 2020-12-04
URL: WS-2020-0208
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-12-04
Fix Resolution: 10.4.1
Step up your Open Source Security Game with Mend here
WS-2019-0540Utility to automatically link the URLs, email addresses, and Twitter handles in a given block of text/HTML
Library home page: https://registry.npmjs.org/autolinker/-/autolinker-0.28.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
Denial of Service (DoS) vulnerability was found in autolinker before 3.0.0. Unterminated img src causes long execution.
Publish Date: 2019-01-08
URL: WS-2019-0540
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-01-08
Fix Resolution: autolinker - 3.0.0
Step up your Open Source Security Game with Mend here
CVE-2024-4067Glob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.
Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
The NPM package micromatch is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of micromatch should follow the fix recommendation as noted.
Publish Date: 2024-05-14
URL: CVE-2024-4067
Base Score Metrics:
Type: Upgrade version
Release Date: 2024-05-14
Fix Resolution: micromatch - 4.0.6
Step up your Open Source Security Game with Mend here
CVE-2023-26144A Query Language and Runtime which can target any service.
Library home page: https://registry.npmjs.org/graphql/-/graphql-16.6.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.
Note: It was not proven that this vulnerability can crash the process.
Publish Date: 2023-09-20
URL: CVE-2023-26144
Base Score Metrics:
Type: Upgrade version
Release Date: 2023-09-20
Fix Resolution: graphql - 16.8.1
Step up your Open Source Security Game with Mend here
CVE-2024-28176
'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, and other Web-interoperable runtimes
Library home page: https://registry.npmjs.org/jose/-/jose-4.10.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Library home page: https://registry.npmjs.org/jose/-/jose-4.11.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has
been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
Publish Date: 2024-03-09
URL: CVE-2024-28176
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-hhhv-q57g-882q
Release Date: 2024-03-09
Fix Resolution: jose - 2.0.7,4.15.5, jose-node-cjs-runtime - 4.15.5, jose-node-esm-runtime - 4.15.5
Step up your Open Source Security Game with Mend here
CVE-2024-30260An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-5.11.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request(). This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
Publish Date: 2024-04-04
URL: CVE-2024-30260
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-m4v8-wqvr-p9f7
Release Date: 2024-04-04
Fix Resolution: undici - 5.28.4,6.11.1
Step up your Open Source Security Game with Mend here
CVE-2024-24758An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-5.11.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authentication headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Publish Date: 2024-02-16
URL: CVE-2024-24758
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-24758
Release Date: 2024-02-16
Fix Resolution: undici - 5.28.3,6.6.1
Step up your Open Source Security Game with Mend here
CVE-2023-45143An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-5.11.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
Publish Date: 2023-10-12
URL: CVE-2023-45143
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-wqq4-5wpv-mx2g
Release Date: 2023-10-12
Fix Resolution: undici - 5.26.2
Step up your Open Source Security Game with Mend here
CVE-2024-30261An HTTP/1.1 client, written from scratch for Node.js
Library home page: https://registry.npmjs.org/undici/-/undici-5.11.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 63a0ea37204ea407b5082710e2a1f8c89eff004a
Found in base branch: main
Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
Publish Date: 2024-04-04
URL: CVE-2024-30261
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-9qxr-qj54-h672
Release Date: 2024-04-04
Fix Resolution: undici - 5.28.4,6.11.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - hono-minimal-0.0.1.tgzPath to dependency file: /package.json
Path to vulnerable library: /package.json,/package.json
| CVE | Severity | CVSS |
Dependency | Type | Fixed in (hono-minimal version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2024-32869 | Medium |
5.3 | hono-2.3.1.tgz | Transitive | N/A* | ❌ |
| CVE-2023-50710 | Medium |
4.3 | hono-2.3.1.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
CVE-2024-32869Ultrafast web framework for Cloudflare Workers.
Library home page: https://registry.npmjs.org/hono/-/hono-2.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json,/package.json
Dependency Hierarchy:
Found in base branch: main
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where main.ts is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.
Publish Date: 2024-04-23
URL: CVE-2024-32869
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-3mpf-rcc7-5347
Release Date: 2024-04-23
Fix Resolution: hono - 4.2.7
Step up your Open Source Security Game with Mend here
CVE-2023-50710Ultrafast web framework for Cloudflare Workers.
Library home page: https://registry.npmjs.org/hono/-/hono-2.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json,/package.json
Dependency Hierarchy:
Found in base branch: main
Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter. Version 3.11.7 includes the change to fix this issue. As a workaround, avoid using TrieRouter directly.
Publish Date: 2023-12-14
URL: CVE-2023-50710
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-f6gv-hh8j-q8vq
Release Date: 2023-12-14
Fix Resolution: hono - 3.11.7
Step up your Open Source Security Game with Mend here
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.