Vulnerabilities

 1 via 1 paths

Dependencies

 66

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity
new

Improper Handling of Unicode Encoding

  • Vulnerable module: protobufjs
  • Introduced through: newrelic@8.10.0

Detailed paths

  • Introduced through: @seneca/telemetry-newrelic@senecajs/seneca-telemetry-newrelic › newrelic@8.10.0 › @grpc/proto-loader@0.6.13 › protobufjs@6.11.6
    Remediation: Upgrade to newrelic@9.7.1.

Overview

protobufjs is a protocol buffer for JavaScript (& TypeScript).

Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in the decoding of overlong UTF-8 strings. An attacker can bypass application-level byte filtering or validation by sending malicious sequences that decode to canonical characters. This is only exploitable if the application decodes protobuf binary data using the minimal UTF-8 decoder and relies on byte-level filtering before string decoding.

Remediation

Upgrade protobufjs to version 7.5.6, 8.0.2, 8.0.3, 8.2.0 or higher.

References

Improper Handling of Unicode Encoding vulnerability report