search

anjanms / DubAPI

A Node.js API for creating queup.net bots.
MIT License
20 stars 10 forks source link

Upgrade to engine.io-client@3.1.4 because of security reasons #37

Closed FranciscoG closed 6 years ago

FranciscoG commented 6 years ago

below info is taken from this report: https://snyk.io/test/npm/dubapi/1.6.8?severity=high&severity=medium&severity=low

high severity

Denial of Service (DoS)

Vulnerable module: ws Introduced through: dubapi@1.6.8 › engine.io-client@2.1.1 › ws@1.1.2 Remediation: Upgrade to engine.io-client@3.1.4

Affected versions of the package are vulnerable to Denial of Service (DoS) attacks. A specially crafted value of the Sec-WebSocket-Extensions header that used Object.prototype property names as extension or parameter names could be used to make a ws server crash.

There are 3 more less severe issues all related to engine.io-client as well so once you upgrade engine.io-client it should fix the other 3 issues as well