src/backend NPM Vulnerability Report

## NPM Vulnerability Report - Tuesday, September 17th, 2024
NPM packages have been checked for vulnerabilities using npm audit.

![HIGHEST_SEVERITY]


[HIGHEST_SEVERITY]: https://img.shields.io/badge/highest_severity-high-9e3302?style=for-the-badge 


⚠️ - 1 `LOW` severity vulnerabilities.
⚠️ - 8 `MODERATE` severity vulnerabilities.
⚠️ - 10 `HIGH` severity vulnerabilities.

 



---
![@nestjs/cli_header]



**Severity**: `moderate`
**Vulnerable Range**: `7.5.1-next.1 || 7.5.2-next.2 - 10.4.4`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


Via `webpack`


 


</details>


**Latest Available Version**: `10.4.5`

This dependency has a `fix available`, and is a `direct dependency` in your package.json. 
See affected dependencies below:

Update `@nestjs/cli` to `10.4.5`.

[@nestjs/cli_header]: https://img.shields.io/badge/@nestjs/cli-f5c60c?style=for-the-badge 


 



---
![@nestjs/core_header]



**Severity**: `high`
**Vulnerable Range**: `5.2.0-next - 5.7.4 || 6.11.0-next.1 - 10.4.1`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


Via `path-to-regexp`


 


</details>


**Latest Available Version**: `10.4.3`

This dependency has a `fix available`, and is a `direct dependency` in your package.json. 
See affected dependencies below:

Update `@nestjs/core` to `10.4.3`.

[@nestjs/core_header]: https://img.shields.io/badge/@nestjs/core-9e3302?style=for-the-badge 


 



---
![@nestjs/platform-express_header]



**Severity**: `high`
**Vulnerable Range**: `<=10.4.1`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


Via `body-parser`

Via `express`


 


</details>


**Latest Available Version**: `10.4.3`

This dependency has a `fix available`, and is a `direct dependency` in your package.json. 
See affected dependencies below:

Update `@nestjs/platform-express` to `10.4.3`.

[@nestjs/platform-express_header]: https://img.shields.io/badge/@nestjs/platform_express-9e3302?style=for-the-badge 


 



---
![@nestjs/swagger_header]



**Severity**: `high`
**Vulnerable Range**: `2.1.0 - 4.0.0 || 4.1.2 - 7.4.0`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


Via `path-to-regexp`


 


</details>


**Latest Available Version**: `7.4.2`

This dependency has a `fix available`, and is a `direct dependency` in your package.json. 
See affected dependencies below:

Update `@nestjs/swagger` to `7.4.2`.

[@nestjs/swagger_header]: https://img.shields.io/badge/@nestjs/swagger-9e3302?style=for-the-badge 


 



---
![axios_header]



**Severity**: `high`
**Vulnerable Range**: `1.3.2 - 1.7.3`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: Server-Side Request Forgery in axios.

**Severity**: `high`
**Vulnerable Range**: `>=1.3.2 <=1.7.3`
**CVSS Score**: `0 / 10`
**Weaknesses**: `CWE-918`

[GitHub Advisory](https://github.com/advisories/GHSA-8hc4-vh64-cxmj) 


 


</details>


**Latest Available Version**: `1.7.7`

This dependency has a `fix available`, but `axios` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `express` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `express` available.


Update from version `4.18.2` to `4.21.0`.


- Direct dependency `dotenv` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `dotenv` available.


Update from version `16.3.1` to `16.4.5`.


- Direct dependency `reflect-metadata` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `reflect-metadata` available.


Update from version `0.1.14` to `0.2.2`.


- Direct dependency `@nestjs/schematics` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `@nestjs/schematics` available.


Update from version `10.0.3` to `10.1.4`.


- Direct dependency `source-map-support` does NOT have a fix available.


- Direct dependency `tsconfig-paths` does NOT have a fix available.


- Direct dependency `typescript` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `typescript` available.


Update from version `5.3.3` to `5.6.2`.


- Direct dependency `@types/node` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `@types/node` available.


Update from version `20.10.4` to `22.5.5`.


- Direct dependency `rxjs` does NOT have a fix available.


</details>


[axios_header]: https://img.shields.io/badge/axios-9e3302?style=for-the-badge 


 



---
![body-parser_header]



**Severity**: `high`
**Vulnerable Range**: `<1.20.3`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: body-parser vulnerable to denial of service when url encoding is enabled.

**Severity**: `high`
**Vulnerable Range**: `<1.20.3`
**CVSS Score**: `7.5 / 10`
**Weaknesses**: `CWE-405`

[GitHub Advisory](https://github.com/advisories/GHSA-qwcr-r2fm-qrc7) 


 


</details>


**Latest Available Version**: `1.20.3`

This dependency has a `fix available`, but `body-parser` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `@nestjs/platform-express` has a fix available. Install version `10.4.3` of `@nestjs/platform-express`.


- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.


</details>


[body-parser_header]: https://img.shields.io/badge/body_parser-9e3302?style=for-the-badge 


 



---
![braces_header]



**Severity**: `high`
**Vulnerable Range**: `<3.0.3`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: Uncontrolled resource consumption in braces.

**Severity**: `high`
**Vulnerable Range**: `<3.0.3`
**CVSS Score**: `7.5 / 10`
**Weaknesses**: `CWE-400,CWE-1050`

[GitHub Advisory](https://github.com/advisories/GHSA-grv7-fg5c-xmjg) 


 


</details>


**Latest Available Version**: `3.0.3`

This dependency has a `fix available`, but `braces` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `express` does NOT have a fix available.


- Direct dependency `dotenv` does NOT have a fix available.


- Direct dependency `reflect-metadata` does NOT have a fix available.


- Direct dependency `@nestjs/schematics` does NOT have a fix available.


- Direct dependency `source-map-support` does NOT have a fix available.


- Direct dependency `tsconfig-paths` does NOT have a fix available.


- Direct dependency `typescript` does NOT have a fix available.


- Direct dependency `@types/node` does NOT have a fix available.


- Direct dependency `rxjs` does NOT have a fix available.


</details>


[braces_header]: https://img.shields.io/badge/braces-9e3302?style=for-the-badge 


 



---
![elliptic_header]



**Severity**: `low`
**Vulnerable Range**: `2.0.0 - 6.5.6`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: Elliptic's EDDSA missing signature length check.

**Severity**: `low`
**Vulnerable Range**: `>=4.0.0 <=6.5.6`
**CVSS Score**: `5.3 / 10`
**Weaknesses**: `CWE-347`

[GitHub Advisory](https://github.com/advisories/GHSA-f7q4-pwc6-w24p) 

`2`: Elliptic's ECDSA missing check for whether leading bit of r and s is zero.

**Severity**: `low`
**Vulnerable Range**: `>=2.0.0 <=6.5.6`
**CVSS Score**: `5.3 / 10`
**Weaknesses**: `CWE-130`

[GitHub Advisory](https://github.com/advisories/GHSA-977x-g7h5-7qgw) 

`3`: Elliptic allows BER-encoded signatures.

**Severity**: `low`
**Vulnerable Range**: `>=5.2.1 <=6.5.6`
**CVSS Score**: `5.3 / 10`
**Weaknesses**: `CWE-347`

[GitHub Advisory](https://github.com/advisories/GHSA-49q7-c7j4-3p7m) 


 


</details>


**Latest Available Version**: `6.5.7`

This dependency has a `fix available`, but `elliptic` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `express` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `express` available.


Update from version `4.18.2` to `4.21.0`.


- Direct dependency `dotenv` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `dotenv` available.


Update from version `16.3.1` to `16.4.5`.


- Direct dependency `reflect-metadata` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `reflect-metadata` available.


Update from version `0.1.14` to `0.2.2`.


- Direct dependency `@nestjs/schematics` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `@nestjs/schematics` available.


Update from version `10.0.3` to `10.1.4`.


- Direct dependency `source-map-support` does NOT have a fix available.


- Direct dependency `tsconfig-paths` does NOT have a fix available.


- Direct dependency `typescript` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `typescript` available.


Update from version `5.3.3` to `5.6.2`.


- Direct dependency `@types/node` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `@types/node` available.


Update from version `20.10.4` to `22.5.5`.


- Direct dependency `rxjs` does NOT have a fix available.


</details>


[elliptic_header]: https://img.shields.io/badge/elliptic-0859A1?style=for-the-badge 


 



---
![express_header]



**Severity**: `high`
**Vulnerable Range**: `<=4.19.2 || 5.0.0-alpha.1 - 5.0.0-beta.3`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: Express.js Open Redirect in malformed URLs.

**Severity**: `moderate`
**Vulnerable Range**: `<4.19.2`
**CVSS Score**: `6.1 / 10`
**Weaknesses**: `CWE-601,CWE-1286`

[GitHub Advisory](https://github.com/advisories/GHSA-rv95-896h-c2vc) 

`2`: express vulnerable to XSS via response.redirect().

**Severity**: `moderate`
**Vulnerable Range**: `<4.20.0`
**CVSS Score**: `5 / 10`
**Weaknesses**: `CWE-79`

[GitHub Advisory](https://github.com/advisories/GHSA-qw6h-vgh9-j6wx) 

Via `body-parser`

Via `path-to-regexp`

Via `send`

Via `serve-static`


 


</details>


**Latest Available Version**: `4.21.0`

This dependency has a `fix available`, and is a `direct dependency` in your package.json. 
See affected dependencies below:

Update `express` to `4.21.0`.

[express_header]: https://img.shields.io/badge/express-9e3302?style=for-the-badge 


 



---
![follow-redirects_header]



**Severity**: `moderate`
**Vulnerable Range**: `<=1.15.5`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: Follow Redirects improperly handles URLs in the url.parse() function.

**Severity**: `moderate`
**Vulnerable Range**: `<1.15.4`
**CVSS Score**: `6.1 / 10`
**Weaknesses**: `CWE-20,CWE-601`

[GitHub Advisory](https://github.com/advisories/GHSA-jchw-25xp-jwwc) 

`2`: follow-redirects' Proxy-Authorization header kept across hosts.

**Severity**: `moderate`
**Vulnerable Range**: `<=1.15.5`
**CVSS Score**: `6.5 / 10`
**Weaknesses**: `CWE-200`

[GitHub Advisory](https://github.com/advisories/GHSA-cxjh-pqwp-8mfp) 


 


</details>


**Latest Available Version**: `1.15.9`

This dependency has a `fix available`, but `follow-redirects` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `express` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `express` available.


Update from version `4.18.2` to `4.21.0`.


- Direct dependency `dotenv` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `dotenv` available.


Update from version `16.3.1` to `16.4.5`.


- Direct dependency `reflect-metadata` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `reflect-metadata` available.


Update from version `0.1.14` to `0.2.2`.


- Direct dependency `@nestjs/schematics` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `@nestjs/schematics` available.


Update from version `10.0.3` to `10.1.4`.


- Direct dependency `source-map-support` does NOT have a fix available.


- Direct dependency `tsconfig-paths` does NOT have a fix available.


- Direct dependency `typescript` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `typescript` available.


Update from version `5.3.3` to `5.6.2`.


- Direct dependency `@types/node` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `@types/node` available.


Update from version `20.10.4` to `22.5.5`.


- Direct dependency `rxjs` does NOT have a fix available.


</details>


[follow-redirects_header]: https://img.shields.io/badge/follow_redirects-f5c60c?style=for-the-badge 


 



---
![lint-staged_header]



**Severity**: `moderate`
**Vulnerable Range**: `7.0.0 - 8.2.1 || 13.3.0 - 15.2.4`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


Via `micromatch`


 


</details>


**Latest Available Version**: `15.2.10`

This dependency has a `fix available`, and is a `direct dependency` in your package.json. 
See affected dependencies below:

Update `lint-staged` to `15.2.10`.

[lint-staged_header]: https://img.shields.io/badge/lint_staged-f5c60c?style=for-the-badge 


 



---
![micromatch_header]



**Severity**: `moderate`
**Vulnerable Range**: `<4.0.8`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: Regular Expression Denial of Service (ReDoS) in micromatch.

**Severity**: `moderate`
**Vulnerable Range**: `<4.0.8`
**CVSS Score**: `5.3 / 10`
**Weaknesses**: `CWE-1333`

[GitHub Advisory](https://github.com/advisories/GHSA-952p-6rrq-rcjv) 


 


</details>


**Latest Available Version**: `4.0.8`

This dependency has a `fix available`, but `micromatch` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `express` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `express` available.


Update from version `4.18.2` to `4.21.0`.


- Direct dependency `dotenv` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `dotenv` available.


Update from version `16.3.1` to `16.4.5`.


- Direct dependency `reflect-metadata` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `reflect-metadata` available.


Update from version `0.1.14` to `0.2.2`.


- Direct dependency `@nestjs/schematics` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `@nestjs/schematics` available.


Update from version `10.0.3` to `10.1.4`.


- Direct dependency `source-map-support` does NOT have a fix available.


- Direct dependency `tsconfig-paths` does NOT have a fix available.


- Direct dependency `typescript` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `typescript` available.


Update from version `5.3.3` to `5.6.2`.


- Direct dependency `@types/node` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `@types/node` available.


Update from version `20.10.4` to `22.5.5`.


- Direct dependency `rxjs` does NOT have a fix available.


- Direct dependency `lint-staged` has a fix available. Install version `15.2.10` of `lint-staged`.


- Direct dependency `ts-loader` has a fix available. Install version `9.5.1` of `ts-loader`.


</details>


[micromatch_header]: https://img.shields.io/badge/micromatch-f5c60c?style=for-the-badge 


 



---
![path-to-regexp_header]



**Severity**: `high`
**Vulnerable Range**: `<=0.1.9 || 2.0.0 - 3.2.0`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: path-to-regexp outputs backtracking regular expressions.

**Severity**: `high`
**Vulnerable Range**: `>=2.0.0 <3.3.0`
**CVSS Score**: `7.5 / 10`
**Weaknesses**: `CWE-1333`

[GitHub Advisory](https://github.com/advisories/GHSA-9wv6-86v2-598j) 

`2`: path-to-regexp outputs backtracking regular expressions.

**Severity**: `high`
**Vulnerable Range**: `<0.1.10`
**CVSS Score**: `7.5 / 10`
**Weaknesses**: `CWE-1333`

[GitHub Advisory](https://github.com/advisories/GHSA-9wv6-86v2-598j) 


 


</details>


**Latest Available Version**: `8.1.0`

This dependency has a `fix available`, but `path-to-regexp` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `@nestjs/core` has a fix available. Install version `10.4.3` of `@nestjs/core`.


- Direct dependency `@nestjs/swagger` has a fix available. Install version `7.4.2` of `@nestjs/swagger`.


- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.


</details>


[path-to-regexp_header]: https://img.shields.io/badge/path_to_regexp-9e3302?style=for-the-badge 


 



---
![pug_header]



**Severity**: `moderate`
**Vulnerable Range**: `<=3.0.2`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: Pug allows JavaScript code execution if an application accepts untrusted input.

**Severity**: `moderate`
**Vulnerable Range**: `<=3.0.2`
**CVSS Score**: `6.8 / 10`
**Weaknesses**: `CWE-94`

[GitHub Advisory](https://github.com/advisories/GHSA-3965-hpx2-q597) 


 


</details>


**Latest Available Version**: `3.0.3`

This dependency has a `fix available`, and is a `direct dependency` in your package.json. 
See affected dependencies below:

Update `pug` to `3.0.3`.

[pug_header]: https://img.shields.io/badge/pug-f5c60c?style=for-the-badge 


 



---
![puppeteer_header]



**Severity**: `high`
**Vulnerable Range**: `11.0.0 - 18.1.0`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


Via `ws`


 


</details>


**Latest Available Version**: `23.3.1`

This dependency has a `fix available`, and is a `direct dependency` in your package.json. 
See affected dependencies below:

Update `puppeteer` to `23.3.1`.

[puppeteer_header]: https://img.shields.io/badge/puppeteer-9e3302?style=for-the-badge 


 



---
![send_header]



**Severity**: `moderate`
**Vulnerable Range**: `<0.19.0`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: send vulnerable to template injection that can lead to XSS.

**Severity**: `moderate`
**Vulnerable Range**: `<0.19.0`
**CVSS Score**: `5 / 10`
**Weaknesses**: `CWE-79`

[GitHub Advisory](https://github.com/advisories/GHSA-m6fv-jmcg-4jfg) 


 


</details>


**Latest Available Version**: `0.19.0`

This dependency has a `fix available`, but `send` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.


- Direct dependency `express` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `express` available.


Update from version `4.18.2` to `4.21.0`.


- Direct dependency `dotenv` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `dotenv` available.


Update from version `16.3.1` to `16.4.5`.


- Direct dependency `reflect-metadata` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `reflect-metadata` available.


Update from version `0.1.14` to `0.2.2`.


- Direct dependency `@nestjs/schematics` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `@nestjs/schematics` available.


Update from version `10.0.3` to `10.1.4`.


- Direct dependency `source-map-support` does NOT have a fix available.


- Direct dependency `tsconfig-paths` does NOT have a fix available.


- Direct dependency `typescript` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `typescript` available.


Update from version `5.3.3` to `5.6.2`.


- Direct dependency `@types/node` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `@types/node` available.


Update from version `20.10.4` to `22.5.5`.


- Direct dependency `rxjs` does NOT have a fix available.


</details>


[send_header]: https://img.shields.io/badge/send-f5c60c?style=for-the-badge 


 



---
![serve-static_header]



**Severity**: `moderate`
**Vulnerable Range**: `<=1.16.0`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: serve-static vulnerable to template injection that can lead to XSS.

**Severity**: `moderate`
**Vulnerable Range**: `<1.16.0`
**CVSS Score**: `5 / 10`
**Weaknesses**: `CWE-79`

[GitHub Advisory](https://github.com/advisories/GHSA-cm22-4g7w-348p) 

Via `send`


 


</details>


**Latest Available Version**: `1.16.2`

This dependency has a `fix available`, but `serve-static` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.


</details>


[serve-static_header]: https://img.shields.io/badge/serve_static-f5c60c?style=for-the-badge 


 



---
![webpack_header]



**Severity**: `moderate`
**Vulnerable Range**: `5.0.0-alpha.0 - 5.93.0`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS.

**Severity**: `moderate`
**Vulnerable Range**: `>=5.0.0-alpha.0 <5.94.0`
**CVSS Score**: `6.4 / 10`
**Weaknesses**: `CWE-79`

[GitHub Advisory](https://github.com/advisories/GHSA-4vvj-4cpr-p986) 


 


</details>


**Latest Available Version**: `5.94.0`

This dependency has a `fix available`, but `webpack` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `@nestjs/cli` has a fix available. Install version `10.4.5` of `@nestjs/cli`.


</details>


[webpack_header]: https://img.shields.io/badge/webpack-f5c60c?style=for-the-badge 


 



---
![ws_header]



**Severity**: `high`
**Vulnerable Range**: `8.0.0 - 8.17.0`

**Via**:
<details>

<summary>
Expand to see vulnerability details. 

</summary>


`1`: ws affected by a DoS when handling a request with many HTTP headers.

**Severity**: `high`
**Vulnerable Range**: `>=8.0.0 <8.17.1`
**CVSS Score**: `7.5 / 10`
**Weaknesses**: `CWE-476`

[GitHub Advisory](https://github.com/advisories/GHSA-3h5v-q93c-6h6q) 


 


</details>


**Latest Available Version**: `8.18.0`

This dependency has a `fix available`, but `ws` is `NOT` a `direct dependency` in your package.json. 
See affected dependencies below:
<details>

<summary>
Expand to see direct dependencies affacted by this vulnerability. 

</summary>

- Direct dependency `puppeteer` has a fix available. Install version `23.3.1` of `puppeteer`.


</details>


[ws_header]: https://img.shields.io/badge/ws-9e3302?style=for-the-badge

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

src/backend NPM Vulnerability Report #2048

NPM Vulnerability Report - Tuesday, September 17th, 2024

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

src/backend NPM Vulnerability Report #2048

Description

NPM Vulnerability Report - Tuesday, September 17th, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions