The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
There is regular Expression Denial of Service (ReDoS) vulnerability in mocha.
It allows cause a denial of service when stripping crafted invalid function definition from strs.
WS-2021-0638 - High Severity Vulnerability
simple, flexible, fun test framework
Library home page: https://registry.npmjs.org/mocha/-/mocha-2.5.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mocha/package.json
Dependency Hierarchy: - :x: **mocha-2.5.3.tgz** (Vulnerable Library)
Found in HEAD commit: b122231e3322e09af113633cfa74ba5f9014c375
Found in base branch: master
There is regular Expression Denial of Service (ReDoS) vulnerability in mocha. It allows cause a denial of service when stripping crafted invalid function definition from strs.
Publish Date: 2021-09-18
URL: WS-2021-0638
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Release Date: 2021-09-18
Fix Resolution: 3.0.0-0
:rescue_worker_helmet: Automatic Remediation is available for this issue