npm audit found vulnerabilities

# npm audit report

async  2.0.0 - 2.6.3
Severity: high
Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25
Depends on vulnerable versions of lodash
fix available via `npm audit fix`
node_modules/async
  mongoose  <=5.13.19 || 6.0.0-rc0 - 6.0.3
  Depends on vulnerable versions of async
  Depends on vulnerable versions of bson
  Depends on vulnerable versions of mongodb
  Depends on vulnerable versions of mpath
  Depends on vulnerable versions of mquery
  node_modules/mongoose

base64url  <3.0.0
Severity: moderate
Out-of-bounds Read in base64url - https://github.com/advisories/GHSA-rvg8-pwq2-xj7q
fix available via `npm audit fix --force`
Will install jsonwebtoken@9.0.2, which is a breaking change
node_modules/base64url
  ecdsa-sig-formatter  1.0.9
  Depends on vulnerable versions of base64url
  node_modules/ecdsa-sig-formatter
    jwa  <=1.1.5
    Depends on vulnerable versions of base64url
    Depends on vulnerable versions of ecdsa-sig-formatter
    node_modules/jwa
      jws  <=3.1.4
      Depends on vulnerable versions of base64url
      Depends on vulnerable versions of jwa
      node_modules/jws
        jsonwebtoken  <=8.5.1
        Depends on vulnerable versions of jws
        node_modules/jsonwebtoken

bson  <=1.1.3
Severity: critical
Deserialization of Untrusted Data in bson - https://github.com/advisories/GHSA-4jwp-vfvf-657p
Deserialization of Untrusted Data in bson - https://github.com/advisories/GHSA-v8w9-2789-6hhr
fix available via `npm audit fix`
node_modules/bson
  mongodb-core  *
  Depends on vulnerable versions of bson
  Depends on vulnerable versions of require_optional
  node_modules/mongodb-core
    mongodb  <=3.1.12
    Depends on vulnerable versions of mongodb-core
    node_modules/mongodb

clean-css  <4.1.11
Regular Expression Denial of Service in clean-css - https://github.com/advisories/GHSA-wxhq-pm8v-cw75
fix available via `npm audit fix --force`
Will install jade@1.9.2, which is a breaking change
node_modules/clean-css
  jade  >=0.30.0
  Depends on vulnerable versions of clean-css
  Depends on vulnerable versions of constantinople
  Depends on vulnerable versions of mkdirp
  Depends on vulnerable versions of transformers
  node_modules/jade

constantinople  <3.1.1
Severity: critical
Sandbox Bypass Leading to Arbitrary Code Execution in constantinople - https://github.com/advisories/GHSA-4vmm-mhcq-4x9j
fix available via `npm audit fix --force`
Will install jade@1.9.2, which is a breaking change
node_modules/constantinople

dicer  *
Severity: high
Crash in HeaderParser in dicer - https://github.com/advisories/GHSA-wm7h-9275-46v2
No fix available
node_modules/dicer
  busboy  <=0.3.1
  Depends on vulnerable versions of dicer
  node_modules/busboy
    express-fileupload  <=1.3.1
    Depends on vulnerable versions of busboy
    node_modules/express-fileupload
    multer  <=2.0.0-rc.3
    Depends on vulnerable versions of busboy
    Depends on vulnerable versions of mkdirp
    node_modules/multer

express  <=4.19.1 || 5.0.0-alpha.1 - 5.0.0-alpha.7
Severity: high
Express.js Open Redirect in malformed URLs - https://github.com/advisories/GHSA-rv95-896h-c2vc
Depends on vulnerable versions of qs
Depends on vulnerable versions of send
Depends on vulnerable versions of serve-static
fix available via `npm audit fix --force`
Will install express@4.19.2, which is outside the stated dependency range
node_modules/express

helmet-csp  1.2.2 - 2.9.0
Severity: moderate
Configuration Override in helmet-csp - https://github.com/advisories/GHSA-c3m8-x3cg-qm2c
fix available via `npm audit fix`
node_modules/helmet-csp
  helmet  2.1.2 - 3.20.1
  Depends on vulnerable versions of helmet-csp
  node_modules/helmet

js-yaml  <=3.13.0
Severity: high
Denial of Service in js-yaml - https://github.com/advisories/GHSA-2pr6-76vf-7546
Code Injection in js-yaml - https://github.com/advisories/GHSA-8j8c-7jfh-h6hx
fix available via `npm audit fix`
node_modules/js-yaml

lodash  <=4.17.20
Severity: critical
Regular Expression Denial of Service (ReDoS) in lodash - https://github.com/advisories/GHSA-x5rq-j2xg-h7qm
Prototype Pollution in lodash - https://github.com/advisories/GHSA-4xc9-xhrj-v574
Regular Expression Denial of Service (ReDoS) in lodash - https://github.com/advisories/GHSA-29mw-wpgm-hmr9
Prototype Pollution in lodash - https://github.com/advisories/GHSA-p6mc-m468-83gw
Command Injection in lodash - https://github.com/advisories/GHSA-35jh-r3h4-6jhm
Prototype Pollution in lodash - https://github.com/advisories/GHSA-jf85-cpcp-j695
fix available via `npm audit fix`
node_modules/lodash
  express-validator  0.2.0 - 6.4.1
  Depends on vulnerable versions of lodash
  Depends on vulnerable versions of validator
  node_modules/express-validator

mime  <1.4.1
Severity: high
mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input - https://github.com/advisories/GHSA-wrvr-8mpx-r7pp
fix available via `npm audit fix --force`
Will install express@4.19.2, which is outside the stated dependency range
node_modules/mime
  send  <=0.15.6
  Depends on vulnerable versions of mime
  node_modules/send
    serve-static  <=1.12.6
    Depends on vulnerable versions of send
    node_modules/serve-static

minimatch  <3.0.5
Severity: high
minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3
fix available via `npm audit fix`
node_modules/minimatch
  glob  3.0.0 - 5.0.14
  Depends on vulnerable versions of minimatch
  node_modules/glob

minimist  <=0.2.3
Severity: critical
Prototype Pollution in minimist - https://github.com/advisories/GHSA-vh95-rmgr-6w4m
Prototype Pollution in minimist - https://github.com/advisories/GHSA-xvch-5gv4-984h
fix available via `npm audit fix --force`
Will install jade@1.9.2, which is a breaking change
node_modules/minimist
  mkdirp  0.4.1 - 0.5.1
  Depends on vulnerable versions of minimist
  node_modules/mkdirp
    mv  
    Depends on vulnerable versions of mkdirp
    node_modules/mv

moment  <=2.29.3
Severity: high
Moment.js vulnerable to Inefficient Regular Expression Complexity - https://github.com/advisories/GHSA-wc69-rhjr-hc9g
Path Traversal: 'dir/../../filename' in moment.locale - https://github.com/advisories/GHSA-8hfj-j24r-96c4
fix available via `npm audit fix`
node_modules/moment
  bunyan  
  Depends on vulnerable versions of moment
  node_modules/bunyan

morgan  <1.9.1
Severity: critical
Code Injection in morgan - https://github.com/advisories/GHSA-gwg9-rgvj-4h5j
fix available via `npm audit fix`
node_modules/morgan

mpath  <=0.8.3
Severity: high
Prototype Pollution in mpath - https://github.com/advisories/GHSA-h466-j336-74wx
Type confusion in mpath - https://github.com/advisories/GHSA-p92x-r36w-9395
fix available via `npm audit fix`
node_modules/mpath

mquery  <3.2.3
Severity: moderate
Code Injection in mquery - https://github.com/advisories/GHSA-45q2-34rf-mr94
fix available via `npm audit fix`
node_modules/mquery

node-serialize  *
Severity: critical
Code Execution through IIFE in node-serialize - https://github.com/advisories/GHSA-q4v7-4rhw-9hqm
No fix available
node_modules/node-serialize

qs  6.5.0 - 6.5.2
Severity: high
qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp
fix available via `npm audit fix --force`
Will install express@4.19.2, which is outside the stated dependency range
node_modules/express/node_modules/qs
node_modules/qs
  body-parser  1.18.0 - 1.18.3
  Depends on vulnerable versions of qs
  node_modules/body-parser

semver  <5.7.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix`
node_modules/semver
  require_optional  
  Depends on vulnerable versions of semver
  node_modules/require_optional

uglify-js  <=2.5.0
Severity: critical
Regular Expression Denial of Service in uglify-js - https://github.com/advisories/GHSA-c9f4-xj24-8jqx
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js - https://github.com/advisories/GHSA-34r7-q49f-h37c
fix available via `npm audit fix --force`
Will install jade@1.9.2, which is a breaking change
node_modules/transformers/node_modules/uglify-js
  transformers  >=2.0.0
  Depends on vulnerable versions of uglify-js
  node_modules/transformers

validator  <13.7.0
Severity: moderate
Inefficient Regular Expression Complexity in validator.js - https://github.com/advisories/GHSA-qgmg-gppg-76g5
fix available via `npm audit fix`
node_modules/validator

44 vulnerabilities (1 low, 14 moderate, 19 high, 10 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

# npm audit report async 2.0.0 - 2.6.3 Severity: high Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25 Depends on vulnerable versions of lodash fix available via `npm audit fix` node_modules/async mongoose <=5.13.19 || 6.0.0-rc0 - 6.0.3 Depends on vulnerable versions of async Depends on vulnerable versions of bson Depends on vulnerable versions of mongodb Depends on vulnerable versions of mpath Depends on vulnerable versions of mquery node_modules/mongoose base64url <3.0.0 Severity: moderate Out-of-bounds Read in base64url - https://github.com/advisories/GHSA-rvg8-pwq2-xj7q fix available via `npm audit fix --force` Will install jsonwebtoken@9.0.2, which is a breaking change node_modules/base64url ecdsa-sig-formatter 1.0.9 Depends on vulnerable versions of base64url node_modules/ecdsa-sig-formatter jwa <=1.1.5 Depends on vulnerable versions of base64url Depends on vulnerable versions of ecdsa-sig-formatter node_modules/jwa jws <=3.1.4 Depends on vulnerable versions of base64url Depends on vulnerable versions of jwa node_modules/jws jsonwebtoken <=8.5.1 Depends on vulnerable versions of jws node_modules/jsonwebtoken bson <=1.1.3 Severity: critical Deserialization of Untrusted Data in bson - https://github.com/advisories/GHSA-4jwp-vfvf-657p Deserialization of Untrusted Data in bson - https://github.com/advisories/GHSA-v8w9-2789-6hhr fix available via `npm audit fix` node_modules/bson mongodb-core * Depends on vulnerable versions of bson Depends on vulnerable versions of require_optional node_modules/mongodb-core mongodb <=3.1.12 Depends on vulnerable versions of mongodb-core node_modules/mongodb clean-css <4.1.11 Regular Expression Denial of Service in clean-css - https://github.com/advisories/GHSA-wxhq-pm8v-cw75 fix available via `npm audit fix --force` Will install jade@1.9.2, which is a breaking change node_modules/clean-css jade >=0.30.0 Depends on vulnerable versions of clean-css Depends on vulnerable versions of constantinople Depends on vulnerable versions of mkdirp Depends on vulnerable versions of transformers node_modules/jade constantinople <3.1.1 Severity: critical Sandbox Bypass Leading to Arbitrary Code Execution in constantinople - https://github.com/advisories/GHSA-4vmm-mhcq-4x9j fix available via `npm audit fix --force` Will install jade@1.9.2, which is a breaking change node_modules/constantinople dicer * Severity: high Crash in HeaderParser in dicer - https://github.com/advisories/GHSA-wm7h-9275-46v2 No fix available node_modules/dicer busboy <=0.3.1 Depends on vulnerable versions of dicer node_modules/busboy express-fileupload <=1.3.1 Depends on vulnerable versions of busboy node_modules/express-fileupload multer <=2.0.0-rc.3 Depends on vulnerable versions of busboy Depends on vulnerable versions of mkdirp node_modules/multer express <=4.19.1 || 5.0.0-alpha.1 - 5.0.0-alpha.7 Severity: high Express.js Open Redirect in malformed URLs - https://github.com/advisories/GHSA-rv95-896h-c2vc Depends on vulnerable versions of qs Depends on vulnerable versions of send Depends on vulnerable versions of serve-static fix available via `npm audit fix --force` Will install express@4.19.2, which is outside the stated dependency range node_modules/express helmet-csp 1.2.2 - 2.9.0 Severity: moderate Configuration Override in helmet-csp - https://github.com/advisories/GHSA-c3m8-x3cg-qm2c fix available via `npm audit fix` node_modules/helmet-csp helmet 2.1.2 - 3.20.1 Depends on vulnerable versions of helmet-csp node_modules/helmet js-yaml <=3.13.0 Severity: high Denial of Service in js-yaml - https://github.com/advisories/GHSA-2pr6-76vf-7546 Code Injection in js-yaml - https://github.com/advisories/GHSA-8j8c-7jfh-h6hx fix available via `npm audit fix` node_modules/js-yaml lodash <=4.17.20 Severity: critical Regular Expression Denial of Service (ReDoS) in lodash - https://github.com/advisories/GHSA-x5rq-j2xg-h7qm Prototype Pollution in lodash - https://github.com/advisories/GHSA-4xc9-xhrj-v574 Regular Expression Denial of Service (ReDoS) in lodash - https://github.com/advisories/GHSA-29mw-wpgm-hmr9 Prototype Pollution in lodash - https://github.com/advisories/GHSA-p6mc-m468-83gw Command Injection in lodash - https://github.com/advisories/GHSA-35jh-r3h4-6jhm Prototype Pollution in lodash - https://github.com/advisories/GHSA-jf85-cpcp-j695 fix available via `npm audit fix` node_modules/lodash express-validator 0.2.0 - 6.4.1 Depends on vulnerable versions of lodash Depends on vulnerable versions of validator node_modules/express-validator mime <1.4.1 Severity: high mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input - https://github.com/advisories/GHSA-wrvr-8mpx-r7pp fix available via `npm audit fix --force` Will install express@4.19.2, which is outside the stated dependency range node_modules/mime send <=0.15.6 Depends on vulnerable versions of mime node_modules/send serve-static <=1.12.6 Depends on vulnerable versions of send node_modules/serve-static minimatch <3.0.5 Severity: high minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3 fix available via `npm audit fix` node_modules/minimatch glob 3.0.0 - 5.0.14 Depends on vulnerable versions of minimatch node_modules/glob minimist <=0.2.3 Severity: critical Prototype Pollution in minimist - https://github.com/advisories/GHSA-vh95-rmgr-6w4m Prototype Pollution in minimist - https://github.com/advisories/GHSA-xvch-5gv4-984h fix available via `npm audit fix --force` Will install jade@1.9.2, which is a breaking change node_modules/minimist mkdirp 0.4.1 - 0.5.1 Depends on vulnerable versions of minimist node_modules/mkdirp mv Depends on vulnerable versions of mkdirp node_modules/mv moment <=2.29.3 Severity: high Moment.js vulnerable to Inefficient Regular Expression Complexity - https://github.com/advisories/GHSA-wc69-rhjr-hc9g Path Traversal: 'dir/../../filename' in moment.locale - https://github.com/advisories/GHSA-8hfj-j24r-96c4 fix available via `npm audit fix` node_modules/moment bunyan Depends on vulnerable versions of moment node_modules/bunyan morgan <1.9.1 Severity: critical Code Injection in morgan - https://github.com/advisories/GHSA-gwg9-rgvj-4h5j fix available via `npm audit fix` node_modules/morgan mpath <=0.8.3 Severity: high Prototype Pollution in mpath - https://github.com/advisories/GHSA-h466-j336-74wx Type confusion in mpath - https://github.com/advisories/GHSA-p92x-r36w-9395 fix available via `npm audit fix` node_modules/mpath mquery <3.2.3 Severity: moderate Code Injection in mquery - https://github.com/advisories/GHSA-45q2-34rf-mr94 fix available via `npm audit fix` node_modules/mquery node-serialize * Severity: critical Code Execution through IIFE in node-serialize - https://github.com/advisories/GHSA-q4v7-4rhw-9hqm No fix available node_modules/node-serialize qs 6.5.0 - 6.5.2 Severity: high qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp fix available via `npm audit fix --force` Will install express@4.19.2, which is outside the stated dependency range node_modules/express/node_modules/qs node_modules/qs body-parser 1.18.0 - 1.18.3 Depends on vulnerable versions of qs node_modules/body-parser semver <5.7.2 Severity: moderate semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw fix available via `npm audit fix` node_modules/semver require_optional Depends on vulnerable versions of semver node_modules/require_optional uglify-js <=2.5.0 Severity: critical Regular Expression Denial of Service in uglify-js - https://github.com/advisories/GHSA-c9f4-xj24-8jqx Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js - https://github.com/advisories/GHSA-34r7-q49f-h37c fix available via `npm audit fix --force` Will install jade@1.9.2, which is a breaking change node_modules/transformers/node_modules/uglify-js transformers >=2.0.0 Depends on vulnerable versions of uglify-js node_modules/transformers validator <13.7.0 Severity: moderate Inefficient Regular Expression Complexity in validator.js - https://github.com/advisories/GHSA-qgmg-gppg-76g5 fix available via `npm audit fix` node_modules/validator 44 vulnerabilities (1 low, 14 moderate, 19 high, 10 critical) To address issues that do not require attention, run: npm audit fix To address all issues possible (including breaking changes), run: npm audit fix --force Some issues need review, and may require choosing a different dependency.

arigsela / gh-actions-npm-audit

npm audit found vulnerabilities #1