@govuk-react/date-input@0.1.28 vulnerabilities | @govuk-react/date-input 0.1.28

Vulnerabilities	1 via 5 paths
Dependencies	33
Source	npm

Vulnerabilities

1 via 5 paths

Dependencies

Source

npm

medium severity

Denial of Service

Vulnerable module: node-fetch
Introduced through: @govuk-react/hoc@0.1.28, @govuk-react/error-text@0.1.28 and others

Detailed paths

Introduced through: @govuk-react/date-input@0.1.28 › @govuk-react/hoc@0.1.28 › @govuk-react/icons@0.1.28 › glamor@2.20.40 › fbjs@0.8.17 › isomorphic-fetch@2.2.1 › node-fetch@1.7.3
Introduced through: @govuk-react/date-input@0.1.28 › @govuk-react/error-text@0.1.28 › @govuk-react/hoc@0.1.28 › @govuk-react/icons@0.1.28 › glamor@2.20.40 › fbjs@0.8.17 › isomorphic-fetch@2.2.1 › node-fetch@1.7.3
Introduced through: @govuk-react/date-input@0.1.28 › @govuk-react/hint-text@0.1.28 › @govuk-react/hoc@0.1.28 › @govuk-react/icons@0.1.28 › glamor@2.20.40 › fbjs@0.8.17 › isomorphic-fetch@2.2.1 › node-fetch@1.7.3
Introduced through: @govuk-react/date-input@0.1.28 › @govuk-react/label@0.1.28 › @govuk-react/hoc@0.1.28 › @govuk-react/icons@0.1.28 › glamor@2.20.40 › fbjs@0.8.17 › isomorphic-fetch@2.2.1 › node-fetch@1.7.3
Introduced through: @govuk-react/date-input@0.1.28 › @govuk-react/label-text@0.1.28 › @govuk-react/hoc@0.1.28 › @govuk-react/icons@0.1.28 › glamor@2.20.40 › fbjs@0.8.17 › isomorphic-fetch@2.2.1 › node-fetch@1.7.3

Overview

node-fetch is an A light-weight module that brings window.fetch to node.js

Affected versions of this package are vulnerable to Denial of Service. Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure.

Remediation

Upgrade node-fetch to version 2.6.1, 3.0.0-beta.9 or higher.

References

GitHub Advisory

Denial of Service vulnerability report

@govuk-react/date-input@0.1.28