Vulnerabilities |
3 via 4 paths |
|---|---|
Dependencies |
405 |
Source |
GitHub |
Find, fix and prevent vulnerabilities in your code.
high severity
ignored
- Vulnerable module: braces
- Introduced through: nodemon@3.1.14
-
Ignored path
∗
-
Expires
never
This issue was ignored via the project's .snyk policy file. To unignore it, update the policy file.
Detailed paths
-
Introduced through: nogin@brettz9/nogin › nodemon@3.1.14 › chokidar@3.6.0 › braces@3.0.3
Overview
braces is a Bash-like brace expansion, implemented in JavaScript.
Affected versions of this package are vulnerable to Uncontrolled Recursion in the recursive AST walkers, which lack depth guards. An attacker can supply deeply nested brace patterns that stay within the character limit to exhaust the call stack and crash the Node.js process with an uncaught RangeError.
Remediation
There is no fixed version for braces.
References
medium severity
new
- Vulnerable module: minimatch
- Introduced through: nodemon@3.1.14, npm-run-all@4.1.5 and others
Detailed paths
-
Introduced through: nogin@brettz9/nogin › nodemon@3.1.14 › minimatch@10.2.6
-
Introduced through: nogin@brettz9/nogin › npm-run-all@4.1.5 › minimatch@3.1.5
-
Introduced through: nogin@brettz9/nogin › stylus@0.64.0 › glob@10.5.0 › minimatch@9.0.9
Overview
minimatch is a minimal matching utility.
Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) in the firstPhasePreProcess method, where the **/.. transform clones a globParts entry and pushes the clone back onto the same array inside a do...while (didSomething) fixpoint loop. An attacker can exhaust CPU and memory by supplying a glob pattern whose **/.. sequences regenerate entries during preprocessing, which secondPhasePreProcess then compares in an O(n^2) pairwise partsMatch pass over the expanded set. Exploitation requires the pattern to be parsed with optimizationLevel set to 2 or higher.
Remediation
Upgrade minimatch to version 11.0.1 or higher.
References
medium severity
new
- Vulnerable module: glob
- Introduced through: stylus@0.64.0
Detailed paths
-
Introduced through: nogin@brettz9/nogin › stylus@0.64.0 › glob@10.5.0
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the walkCB, walkCB2, walkCBSync, and walkCB2Sync methods of src/walker.ts, where each abort branch calls cb() without returning. An attacker can keep a walk consuming filesystem I/O and CPU after it has already been aborted, by driving a traversal that the caller tries to bound, because execution continues past the abort into processPatterns(), readdirCB(), and recursive walkCB2() calls. This affects only callers that rely on the signal option or AbortSignal.timeout() to cancel a walk, and applies to both glob() and globStream().
Remediation
Upgrade glob to version 13.0.7, 14.0.2 or higher.