search

caolan / async

Async utilities for node and the browser
http://caolan.github.io/async/
MIT License
28.15k stars 2.41k forks source link

CVE-2024-39249 reported for async-3.2.5 #1977

Closed wanghwh closed 1 month ago

wanghwh commented 1 month ago

What version of async are you using? 3.2.5 Which environment did the issue occur in (Node/browser/Babel/Typescript version) Node

What did you do? Please include a minimal reproducible case illustrating issue. development using winston , which depends on async

What did you expect to happen? Remediate this CVE https://nvd.nist.gov/vuln/detail/CVE-2024-39249

What was the actual result? Vulnerability reported by WhiteSource Security Check during our build pipeline

aearly commented 1 month ago

Dupe of #1975