Vulnerabilities

 2 via 2 paths

Dependencies

 34

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
Status
  • 2
  • 0
  • 0

high severity

Uncontrolled Recursion

  • Vulnerable module: braces
  • Introduced through: locter@4.1.2

Detailed paths

  • Introduced through: typeorm-extension@Tada5hi/typeorm-extension › locter@4.1.2 › fast-glob@3.3.3 › micromatch@4.0.8 › braces@3.0.3

Overview

braces is a Bash-like brace expansion, implemented in JavaScript.

Affected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to exhaust the call stack and crash the Node.js process with an uncaught RangeError.

Remediation

There is no fixed version for braces.

References

Uncontrolled Recursion vulnerability report

high severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: flat
  • Introduced through: locter@4.1.2

Detailed paths

  • Introduced through: typeorm-extension@Tada5hi/typeorm-extension › locter@4.1.2 › flat@6.0.1

Overview

flat is a Take a nested Javascript object and flatten it, or unflatten an object with delimited keys

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unflatten(), which creates huge sparse arrays when processing flattened objects whose keys contain unbounded numeric indices. An attacker can supply keys such as a.4294967294, causing the resulting sparse array to consume excessive memory, and subsequent iteration with forEach, spread, or JSON.stringify to block the Node.js event loop.

Remediation

There is no fixed version for flat.

References

Allocation of Resources Without Limits or Throttling vulnerability report