Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to CRLF Injection via the _multiPartHeader function when untrusted input is provided via field or filename to FormData#append. An attacker can inject additional headers or multipart parts by including carriage returns, line feeds, or double quotes in the input. This can allow the modification or addition of form fields visible to downstream parsers.

PoC

const FormData = require('form-data');
const form = new FormData();
form.append('email"\r\nX-Injected: true\r\nfake="', 'user@example.com');
console.log(form.getBuffer().toString());

Remediation

Upgrade form-data to version 2.5.6, 3.0.5, 4.0.6 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Maintainer's Advisory

Overview

qs is a querystring parser that supports nesting and arrays, with a depth limit.

Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer() function in lib/utils.js, which calls obj.constructor.isBuffer(obj) without checking that it is callable, reached from stringify() at lib/stringify.js:127. An attacker can throw an uncaught TypeError that fails each request with HTTP 500, and terminates the worker process when stringify() runs in an unguarded async context, by supplying a query string such as x[constructor][isBuffer]=y that sets constructor.isBuffer to a non-function value. This requires the application to call qs.parse() with plainObjects: true or allowPrototypes: true, which preserves the constructor own property, and to then pass the parsed result to qs.stringify().

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade qs to version 6.16.0 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Directory Traversal through getFilenameFromUrl in src/middleware.js. An attacker can read files outside the configured output directory by sending a request whose path shares a publicPath prefix without actually being under it, such as /static../secret.txt when publicPath is /static. When the middleware joins that stripped path to outputPath, the request resolves above the served root and returns the targeted file contents instead of rejecting the request. Applications exposing webpack-dev-middleware, directly or through webpack-dev-server, with a non-slash-terminated publicPath are affected.

Workarounds

• Configure publicPath with a trailing slash, for example /assets/ instead of /assets, to prevent requests like /assets../secret from being treated as if they were under the served prefix and escaping the output directory.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade webpack-dev-middleware to version 7.4.6, 8.3.0 or higher.

References

• GitHub Commit
• GitHub Commit v7.4.6
• GitHub Issue
• Maintainer's Advisory

Overview

webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only.

Affected versions of this package are vulnerable to Improper Input Validation through the host-validation process. An attacker can cause the server to terminate unexpectedly by sending a malformed Host or Origin header in an HTTP request or WebSocket upgrade.

Remediation

Upgrade webpack-dev-server to version 5.2.6 or higher.

References

• GitHub Advisory
• GitHub Commit
• Vendor Advisory

Overview

webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only.

Affected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via permissive user proxy configurations that include a broad context and enable WebSocket forwarding. An attacker can cause the interception and forwarding of the dev server's own HMR WebSocket, leading to the leakage of browser cookies and Origin headers to the backend, bypassing Host/Origin validation, and corrupting the HMR socket by having both the proxy and the dev server write to the same socket.

Workaround

This vulnerability can be mitigated by scoping user-defined proxy contexts to specific paths instead of '/', or by omitting 'ws: true' from the proxy entry when WebSocket forwarding is not required.

Remediation

Upgrade webpack-dev-server to version 5.2.5 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• OpenJS Advisories

Overview

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to insufficient checks in the lib/redirect.js file by allowing insecure redirects in the default configuration, via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).

NOTE: request package has been deprecated, so a fix is not expected. See https://github.com/request/request/issues/3142.

Remediation

Upgrade @cypress/request to version 3.0.0 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

uuid is a RFC4122 (v1, v4, and v5) compliant UUID library.

Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes (small buf or large offset). This inconsistency allows silent partial writes into caller-provided buffers.

PoC

cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4',()=>v4({},new Uint8Array(8),4)],
  ['v5',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Remediation

Upgrade uuid to version 11.1.1, 14.0.0 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres function due to improperly deleting keys from the reqs object after execution of callbacks. This behavior causes the keys to remain in the reqs object, which leads to resource exhaustion.

Exploiting this vulnerability results in crashing the node process or in the application crash.

Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.

To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.

PoC

const inflight = require('inflight');

function testInflight() {
  let i = 0;
  function scheduleNext() {
    let key = `key-${i++}`;
    const callback = () => {
    };
    for (let j = 0; j < 1000000; j++) {
      inflight(key, callback);
    }

    setImmediate(scheduleNext);
  }


  if (i % 100 === 0) {
    console.log(process.memoryUsage());
  }

  scheduleNext();
}

testInflight();

Remediation

There is no fixed version for inflight.

References

• GitHub Issue
• GitHub PR

Overview

webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only.

Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via the __webpack_modules__ object. An attacker can extract sensitive source code by injecting a malicious script into their site that utilizes Function::toString to access and serialize the functions stored within __webpack_modules__.

Note: This is only exploitable if the attacker knows both the specific port and the output entrypoint script path.

Remediation

Upgrade webpack-dev-server to version 5.2.1 or higher.

References

• GitHub Commit
• GitHub Release
• Exploit DB

Overview

webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only.

Affected versions of this package are vulnerable to Exposed Dangerous Method or Function in Server.js, when handling non-HTTPS responses. An attacker can expose source code by tricking a developer into visiting a malicious site that retrieves the code via <script> element. This is only exploitable while the development server is running over plain HTTP, by the attacker guessing the target host and port.

Note: This is a bypass of the fix for the vulnerability described in CVE-2025-30359, which blocks the cross-origin leak for trusted (HTTPS) connections only.

Remediation

Upgrade webpack-dev-server to version 5.2.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• Exploit DB

Overview

webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the open-editor and invalidate endpoints. An attacker can open arbitrary local files in the developer's editor and repeatedly trigger recompilations, potentially degrading system performance, by enticing a developer to visit a malicious website while the development server is running.

Remediation

Upgrade webpack-dev-server to version 5.2.6 or higher.

References

• GitHub Advisory
• GitHub Commit
• Vendor Advisory
• Exploit DB