albertomr86 / nestjs-param-store

Configure your NestJS application with AWS Parameter Store
MIT License
5 stars 4 forks source link

update deps (fast-xml-parser vuln) #15

Open fauxbytes opened 3 weeks ago

fauxbytes commented 3 weeks ago
$ git log -1 --oneline
2aa0d8e (HEAD -> main, tag: v1.3.1, upstream/main, origin/main, origin/HEAD) 7:add support for NestJS 10 (#14)
$ npm audit
# npm audit report

braces  <3.0.3
Severity: high
Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
fix available via `npm audit fix`
node_modules/braces

express  <4.19.2
Severity: moderate
Express.js Open Redirect in malformed URLs - https://github.com/advisories/GHSA-rv95-896h-c2vc
fix available via `npm audit fix`
node_modules/express
  @nestjs/platform-express  <=10.3.5
  Depends on vulnerable versions of express
  node_modules/@nestjs/platform-express

fast-xml-parser  <4.4.1
Severity: high
fast-xml-parser vulnerable to ReDOS at currency parsing - https://github.com/advisories/GHSA-mpg4-rc92-vx8v
fix available via `npm audit fix`
node_modules/fast-xml-parser
  @aws-sdk/client-sts  <=3.186.3 || 3.188.0 - 3.525.0
  Depends on vulnerable versions of fast-xml-parser
  node_modules/@aws-sdk/client-sts
    @aws-sdk/client-ssm  3.12.0 - 3.525.0
    Depends on vulnerable versions of @aws-sdk/client-sts
    node_modules/@aws-sdk/client-ssm

6 vulnerabilities (2 moderate, 4 high)

To address all issues, run:
  npm audit fix
fauxbytes commented 3 weeks ago

#16