You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
npm audit reports 14 vulnerabilities (9 moderate, 3 high, 2 critical) with dependencies. One of these (passport) requires a breaking change from ^0.4.1 to ^0.6.0.
Any relevant logs, error output, etc?
If it's long, please link to a relevant public GitHub Gist
npm audit report
npm audit report
ansi-regex 5.0.0
Severity: high
Inefficient Regular Expression Complexity in chalk/ansi-regex - GHSA-93q8-gq69-wqmw
fix available via npm audit fix
node_modules/ansi-regex
minimist <1.2.6
Severity: critical
Prototype Pollution in minimist - GHSA-xvch-5gv4-984h
fix available via npm audit fix
node_modules/minimist
node-forge <=1.2.1
Severity: high
Open Redirect in node-forge - GHSA-8fr3-hfg3-gpgp
Prototype Pollution in node-forge debug API. - GHSA-5rrq-pxf6-6jx5
Improper Verification of Cryptographic Signature in node-forge - GHSA-2r2c-g63r-vccr
Improper Verification of Cryptographic Signature in node-forge - GHSA-x4jg-mjrx-434g
Improper Verification of Cryptographic Signature in node-forge - GHSA-cfm4-qjh2-4765
URL parsing in node-forge could lead to undesired behavior. - GHSA-gf8q-jrpm-jvxq
fix available via npm audit fix
node_modules/node-forge
xml-encryption <=1.3.0
Depends on vulnerable versions of node-forge
Depends on vulnerable versions of xmldom
node_modules/xml-encryption
passport-saml 0.0.2 - 3.2.0
Depends on vulnerable versions of xml-encryption
Depends on vulnerable versions of xmldom
node_modules/passport-saml
passport <0.6.0
Severity: moderate
Passport before 0.6.0 vulnerable to session regeneration when a users logs in or out - GHSA-v923-w3x8-wh69
fix available via npm audit fix --force
Will install [email protected], which is a breaking change
node_modules/passport
shell-quote <=1.7.2
Severity: critical
Improper Neutralization of Special Elements used in a Command in Shell-quote - GHSA-g4rg-993r-mgx7
fix available via npm audit fix
node_modules/shell-quote
swagger-ui-dist <=4.1.2
Severity: moderate
Spoofing attack in swagger-ui-dist - GHSA-6c9x-mj3g-h47x
Server side request forgery in SwaggerUI - GHSA-qrmm-w75w-3wpx
fix available via npm audit fix
node_modules/swagger-ui-dist
swagger-ui-express 4.0.0 - 4.1.6
Depends on vulnerable versions of swagger-ui-dist
node_modules/swagger-ui-express
tmpl <1.0.5
Severity: high
tmpl vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion - GHSA-jgrx-mgxx-jf9v
fix available via npm audit fix
node_modules/tmpl
validator <=13.6.0
Severity: moderate
Inefficient Regular Expression Complexity in validator.js - GHSA-qgmg-gppg-76g5
Inefficient Regular Expression Complexity in Validator.js - GHSA-xx4c-jj58-r7x6
fix available via npm audit fix
node_modules/validator
node_modules/z-schema/node_modules/validator
z-schema 4.2.3 || 5.0.0
Depends on vulnerable versions of validator
node_modules/z-schema
xmldom *
Severity: moderate
Misinterpretation of malicious XML input - GHSA-5fg8-2547-mr8q
fix available via npm audit fix
node_modules/xmldom
xml-crypto <=1.5.5 || 2.0.0 - 2.1.2
Depends on vulnerable versions of xmldom
node_modules/xml-crypto
The text was updated successfully, but these errors were encountered:
Subject of the issue
npm audit
reports 14 vulnerabilities (9 moderate, 3 high, 2 critical) with dependencies. One of these (passport
) requires a breaking change from^0.4.1
to^0.6.0
.Any relevant logs, error output, etc?
If it's long, please link to a relevant public GitHub Gist
npm audit report
npm audit report
ansi-regex 5.0.0
Severity: high
Inefficient Regular Expression Complexity in chalk/ansi-regex - GHSA-93q8-gq69-wqmw
fix available via
npm audit fix
node_modules/ansi-regex
minimist <1.2.6
Severity: critical
Prototype Pollution in minimist - GHSA-xvch-5gv4-984h
fix available via
npm audit fix
node_modules/minimist
node-forge <=1.2.1
Severity: high
Open Redirect in node-forge - GHSA-8fr3-hfg3-gpgp
Prototype Pollution in node-forge debug API. - GHSA-5rrq-pxf6-6jx5
Improper Verification of Cryptographic Signature in
node-forge
- GHSA-2r2c-g63r-vccrImproper Verification of Cryptographic Signature in node-forge - GHSA-x4jg-mjrx-434g
Improper Verification of Cryptographic Signature in node-forge - GHSA-cfm4-qjh2-4765
URL parsing in node-forge could lead to undesired behavior. - GHSA-gf8q-jrpm-jvxq
fix available via
npm audit fix
node_modules/node-forge
xml-encryption <=1.3.0
Depends on vulnerable versions of node-forge
Depends on vulnerable versions of xmldom
node_modules/xml-encryption
passport-saml 0.0.2 - 3.2.0
Depends on vulnerable versions of xml-encryption
Depends on vulnerable versions of xmldom
node_modules/passport-saml
passport <0.6.0
Severity: moderate
Passport before 0.6.0 vulnerable to session regeneration when a users logs in or out - GHSA-v923-w3x8-wh69
fix available via
npm audit fix --force
Will install [email protected], which is a breaking change
node_modules/passport
shell-quote <=1.7.2
Severity: critical
Improper Neutralization of Special Elements used in a Command in Shell-quote - GHSA-g4rg-993r-mgx7
fix available via
npm audit fix
node_modules/shell-quote
swagger-ui-dist <=4.1.2
Severity: moderate
Spoofing attack in swagger-ui-dist - GHSA-6c9x-mj3g-h47x
Server side request forgery in SwaggerUI - GHSA-qrmm-w75w-3wpx
fix available via
npm audit fix
node_modules/swagger-ui-dist
swagger-ui-express 4.0.0 - 4.1.6
Depends on vulnerable versions of swagger-ui-dist
node_modules/swagger-ui-express
tmpl <1.0.5
Severity: high
tmpl vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion - GHSA-jgrx-mgxx-jf9v
fix available via
npm audit fix
node_modules/tmpl
validator <=13.6.0
Severity: moderate
Inefficient Regular Expression Complexity in validator.js - GHSA-qgmg-gppg-76g5
Inefficient Regular Expression Complexity in Validator.js - GHSA-xx4c-jj58-r7x6
fix available via
npm audit fix
node_modules/validator
node_modules/z-schema/node_modules/validator
z-schema 4.2.3 || 5.0.0
Depends on vulnerable versions of validator
node_modules/z-schema
xmldom *
Severity: moderate
Misinterpretation of malicious XML input - GHSA-5fg8-2547-mr8q
fix available via
npm audit fix
node_modules/xmldom
xml-crypto <=1.5.5 || 2.0.0 - 2.1.2
Depends on vulnerable versions of xmldom
node_modules/xml-crypto
The text was updated successfully, but these errors were encountered: