[Snyk] Security upgrade express from 4.17.1 to 4.21.0 #8
Conversation
…ce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-BODYPARSER-7926860 - https://snyk.io/vuln/SNYK-JS-EXPRESS-7926867 - https://snyk.io/vuln/SNYK-JS-SEND-7926862 - https://snyk.io/vuln/SNYK-JS-SERVESTATIC-7926865
✅ Fix Vulnerabilitieslib/backend/package-lock.jsonCVE-2022-24999: express: "qs" prototype poisoning causes the hang of the node process (HIGH)
Descriptionqs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable). References
CVE-2024-43799: send: Code Execution Vulnerability in Send Library (MEDIUM)
DescriptionSend is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0. ReferencesCVE-2024-43800: serve-static: Improper Sanitization in serve-static (MEDIUM)
Descriptionserve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0. ReferencesCVE-2024-45590: body-parser: Denial of Service Vulnerability in body-parser (HIGH)
Descriptionbody-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3. ReferencesCVE-2024-29041: express: cause malformed URLs to be evaluated (MEDIUM)
DescriptionExpress.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using References
CVE-2024-43796: express: Improper Input Handling in Express Redirects (MEDIUM)
DescriptionExpress.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0. ReferencesCVE-2024-45296: path-to-regexp: Backtracking regular expressions cause ReDoS (HIGH)
Descriptionpath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0. References
|
Snyk has created this PR to fix 4 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
lib/backend/package.jsonlib/backend/package-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-BODYPARSER-7926860
SNYK-JS-EXPRESS-7926867
SNYK-JS-SEND-7926862
SNYK-JS-SERVESTATIC-7926865
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Cross-site Scripting