Update Mime to fix https://nodesecurity.io/advisories/535

andrewrk / node-s3-client

high level amazon s3 client for node.js

MIT License

1k stars 303 forks source link

Update Mime to fix https://nodesecurity.io/advisories/535 #191

Open carterbancroft opened 6 years ago

carterbancroft commented 6 years ago

Fixes https://github.com/andrewrk/node-s3-client/issues/190

A RegEx denial of service attack was discovered/reported in the Mime package breaking CI builds for anyone using Node Package Security in their build process. The exploit has been fixed in Mime v1.4.1 and v2.0.3, see: https://github.com/broofa/node-mime/releases

sam-breed-ck commented 6 years ago

@andrewrk any indication of when this will be merged? automated nsp checks in CI are pretty common, and I'd hate to have to use a fork because of this 🚫 🍴

Thanks!

StoneCypher commented 6 years ago

@andrewrk please merge

carterbancroft commented 6 years ago

@andrewrk yeah just checking in on getting this merged... I know someone has forked it but it seems like it'd be ideal to fix this in the original repo.