Vulnerabilities

 4 via 4 paths

Dependencies

 48

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
  • 2
Status
  • 4
  • 0
  • 0

high severity
new

Infinite loop

  • Vulnerable module: nanoid
  • Introduced through: shortid@2.2.16

Detailed paths

  • Introduced through: lockfix@kopach/lockfix › shortid@2.2.16 › nanoid@2.1.11
    Remediation: Upgrade to shortid@2.2.17.

Overview

Affected versions of this package are vulnerable to Infinite loop through the customAlphabet and nanoid functions in nanoid/non-secure. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.

Notes

  • The vulnerable code path is in the nanoid/non-secure entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.
  • The denial-of-service only shows up when callers pass a negative size into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.

Remediation

Upgrade nanoid to version 3.3.16, 5.1.16 or higher.

References

Infinite loop vulnerability report

high severity
new

Infinite loop

  • Vulnerable module: nanoid
  • Introduced through: shortid@2.2.16

Detailed paths

  • Introduced through: lockfix@kopach/lockfix › shortid@2.2.16 › nanoid@2.1.11
    Remediation: Upgrade to shortid@2.2.17.

Overview

Affected versions of this package are vulnerable to Infinite loop through the customRandom function in the customRandom implementation. An attacker can hang the calling thread by supplying a size of 0 to customRandom, which causes its ID generation loop to never reach a terminating condition. This breaks any application path that accepts an unvalidated, attacker-controlled size and passes it into customRandom, leaving the process stuck while handling the request.

Remediation

Upgrade nanoid to version 3.3.17, 5.1.6 or higher.

References

Infinite loop vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: nanoid
  • Introduced through: shortid@2.2.16

Detailed paths

  • Introduced through: lockfix@kopach/lockfix › shortid@2.2.16 › nanoid@2.1.11
    Remediation: Upgrade to shortid@2.2.17.

Overview

Affected versions of this package are vulnerable to Improper Input Validation due to the mishandling of fractional values in the nanoid function. By exploiting this vulnerability, an attacker can achieve an infinite loop.

Remediation

Upgrade nanoid to version 3.3.8, 5.0.9 or higher.

References

Improper Input Validation vulnerability report

medium severity

Missing Release of Resource after Effective Lifetime

  • Vulnerable module: inflight
  • Introduced through: shelljs@0.8.5

Detailed paths

  • Introduced through: lockfix@kopach/lockfix › shelljs@0.8.5 › glob@7.2.3 › inflight@1.0.6

Overview

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres function due to improperly deleting keys from the reqs object after execution of callbacks. This behavior causes the keys to remain in the reqs object, which leads to resource exhaustion.

Exploiting this vulnerability results in crashing the node process or in the application crash.

Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.

To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.

PoC

const inflight = require('inflight');

function testInflight() {
  let i = 0;
  function scheduleNext() {
    let key = `key-${i++}`;
    const callback = () => {
    };
    for (let j = 0; j < 1000000; j++) {
      inflight(key, callback);
    }

    setImmediate(scheduleNext);
  }


  if (i % 100 === 0) {
    console.log(process.memoryUsage());
  }

  scheduleNext();
}

testInflight();

Remediation

There is no fixed version for inflight.

References

Missing Release of Resource after Effective Lifetime vulnerability report