Find, fix and prevent vulnerabilities in your code.
high severity
new
- Vulnerable module: immutable
- Introduced through: immutable@3.8.3 and redux-immutable@3.1.0
Detailed paths
-
Introduced through: reactjs-boilerplate@nicholas-b-carter/progressive-react#HEAD › immutable@3.8.3Remediation: Upgrade to immutable@4.3.9.
-
Introduced through: reactjs-boilerplate@nicholas-b-carter/progressive-react#HEAD › redux-immutable@3.1.0 › immutable@3.8.3Remediation: Upgrade to redux-immutable@4.0.0.
Overview
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the HashCollisionNode class in Immutable.Map and Immutable.Set. An attacker can cause excessive CPU consumption by supplying a large number of keys with identical 32-bit hashes, leading to degraded insertion and lookup performance through crafted input objects.
Remediation
Upgrade immutable to version 4.3.9, 5.1.8 or higher.
References
high severity
new
- Vulnerable module: immutable
- Introduced through: immutable@3.8.3 and redux-immutable@3.1.0
Detailed paths
-
Introduced through: reactjs-boilerplate@nicholas-b-carter/progressive-react#HEAD › immutable@3.8.3Remediation: Upgrade to immutable@4.3.9.
-
Introduced through: reactjs-boilerplate@nicholas-b-carter/progressive-react#HEAD › redux-immutable@3.1.0 › immutable@3.8.3Remediation: Upgrade to redux-immutable@4.0.0.
Overview
Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the setListBounds function in src/List.js when handling an index or size in the range 2 ** 30 to 2 ** 31. An attacker can cause an empty list to enter an uncatchable infinite loop, trigger unbounded memory allocation until process abort, or cause silent value wrapping by supplying crafted input values.
Remediation
Upgrade immutable to version 4.3.9, 5.1.8 or higher.
References
medium severity
- Vulnerable module: node-fetch
- Introduced through: react@15.7.0 and react-dom@15.7.0
Detailed paths
-
Introduced through: reactjs-boilerplate@nicholas-b-carter/progressive-react#HEAD › react@15.7.0 › fbjs@0.8.18 › isomorphic-fetch@2.2.1 › node-fetch@1.7.3Remediation: Upgrade to react@16.5.0.
-
Introduced through: reactjs-boilerplate@nicholas-b-carter/progressive-react#HEAD › react-dom@15.7.0 › fbjs@0.8.18 › isomorphic-fetch@2.2.1 › node-fetch@1.7.3Remediation: Upgrade to react-dom@16.5.0.
Overview
node-fetch is a light-weight module that brings window.fetch to node.js
Affected versions of this package are vulnerable to Information Exposure when fetching a remote url with Cookie, if it get a Location response header, it will follow that url and try to fetch that url with provided cookie. This can lead to forwarding secure headers to 3th party.
Remediation
Upgrade node-fetch to version 2.6.7, 3.1.1 or higher.
References
medium severity
- Vulnerable module: node-fetch
- Introduced through: react@15.7.0 and react-dom@15.7.0
Detailed paths
-
Introduced through: reactjs-boilerplate@nicholas-b-carter/progressive-react#HEAD › react@15.7.0 › fbjs@0.8.18 › isomorphic-fetch@2.2.1 › node-fetch@1.7.3Remediation: Upgrade to react@16.5.0.
-
Introduced through: reactjs-boilerplate@nicholas-b-carter/progressive-react#HEAD › react-dom@15.7.0 › fbjs@0.8.18 › isomorphic-fetch@2.2.1 › node-fetch@1.7.3Remediation: Upgrade to react-dom@16.5.0.
Overview
node-fetch is a light-weight module that brings window.fetch to node.js
Affected versions of this package are vulnerable to Denial of Service (DoS). Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure.
Remediation
Upgrade node-fetch to version 2.6.1, 3.0.0-beta.9 or higher.