Vulnerabilities |
4 via 6 paths |
|---|---|
Dependencies |
421 |
Source |
GitHub |
Find, fix and prevent vulnerabilities in your code.
high severity
new
- Vulnerable module: brace-expansion
- Introduced through: testcontainers@12.0.4
Detailed paths
-
Introduced through: @tresdoce-nestjs-toolkit/root@tresdoce/tresdoce-nestjs-toolkit › testcontainers@12.0.4 › archiver@7.0.1 › readdir-glob@1.1.3 › minimatch@5.1.9 › brace-expansion@2.1.1
-
Introduced through: @tresdoce-nestjs-toolkit/root@tresdoce/tresdoce-nestjs-toolkit › testcontainers@12.0.4 › archiver@7.0.1 › archiver-utils@5.0.2 › glob@10.5.0 › minimatch@9.0.9 › brace-expansion@2.1.1
-
Introduced through: @tresdoce-nestjs-toolkit/root@tresdoce/tresdoce-nestjs-toolkit › testcontainers@12.0.4 › archiver@7.0.1 › zip-stream@6.0.1 › archiver-utils@5.0.2 › glob@10.5.0 › minimatch@9.0.9 › brace-expansion@2.1.1
Overview
brace-expansion is a Brace expansion as known from sh/bash
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the expand function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The max option does not prevent this issue, as it only limits the output size and not the computational workload.
Remediation
Upgrade brace-expansion to version 5.0.7 or higher.
References
high severity
new
- Vulnerable module: multer
- Introduced through: @nestjs/platform-express@11.1.27
Detailed paths
-
Introduced through: @tresdoce-nestjs-toolkit/root@tresdoce/tresdoce-nestjs-toolkit › @nestjs/platform-express@11.1.27 › multer@2.1.1
Overview
Affected versions of this package are vulnerable to Uncontrolled Recursion via deeply nested field names in multipart form data. An attacker can exhaust CPU and memory resources by sending a single HTTP request with a crafted multipart body containing excessively nested field names.
Workaround
This vulnerability can be mitigated by setting the limits.fields option to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
Remediation
Upgrade multer to version 2.2.0, 3.0.0-alpha.2 or higher.
References
medium severity
new
- Vulnerable module: multer
- Introduced through: @nestjs/platform-express@11.1.27
Detailed paths
-
Introduced through: @tresdoce-nestjs-toolkit/root@tresdoce/tresdoce-nestjs-toolkit › @nestjs/platform-express@11.1.27 › multer@2.1.1
Overview
Affected versions of this package are vulnerable to Incomplete Cleanup in the diskStorage function. An attacker can exhaust disk space by repeatedly initiating and aborting multipart uploads, causing orphaned partial files to accumulate on disk.
Remediation
Upgrade multer to version 2.2.0, 3.0.0-alpha.2 or higher.
References
medium severity
- Vulnerable module: uuid
- Introduced through: dynamoose-logger@4.2.0
Detailed paths
-
Introduced through: @tresdoce-nestjs-toolkit/root@tresdoce/tresdoce-nestjs-toolkit › dynamoose-logger@4.2.0 › uuid@9.0.1
Overview
uuid is a RFC4122 (v1, v4, and v5) compliant UUID library.
Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes (small buf or large offset). This inconsistency allows silent partial writes into caller-provided buffers.
PoC
cd /home/StrawHat/uuid
npm ci
npm run build
node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
['v4',()=>v4({},new Uint8Array(8),4)],
['v5',()=>v5('x',ns,new Uint8Array(8),4)],
['v6',()=>v6({},new Uint8Array(8),4)],
]) {
try { fn(); console.log(name,'NO_THROW'); }
catch(e){ console.log(name,'THREW',e.name); }
}"
Remediation
Upgrade uuid to version 11.1.1, 14.0.0 or higher.