search

sahat / hackathon-starter

A boilerplate for Node.js web applications
MIT License
34.8k stars 8.16k forks source link

Migrate off passport-twitch-new #1230

Closed YasharF closed 1 year ago

YasharF commented 1 year ago

The package is unmaintained and is using a vulnerable dependency:

jsonwebtoken  <=8.5.1
Severity: moderate
jsonwebtoken unrestricted key type could lead to legacy keys usage  - https://github.com/advisories/GHSA-8cf7-32gw-wr33
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - https://github.com/advisories/GHSA-hjrf-2m68-5959
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() - https://github.com/advisories/GHSA-qwph-4952-7xr6
No fix available
node_modules/jsonwebtoken
  passport-twitch-new  *
  Depends on vulnerable versions of jsonwebtoken
  node_modules/passport-twitch-new
YasharF commented 1 year ago

Fixed: https://github.com/sahat/hackathon-starter/commit/f02e012991cc3487476c4b2d0566ce77a05b1071