The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Mend Note: Converted from WS-2017-0330, on 2022-11-08.
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.
Fast, unopinionated, minimalist web framework
Library home page: https://registry.npmjs.org/express/-/express-4.13.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/express/package.json
Found in HEAD commit: 6c7cc801274c55a47ba8227e24b2d4724302bea1
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2017-16138
### Vulnerable Library - mime-1.3.4.tgzA comprehensive library for mime-type mapping
Library home page: https://registry.npmjs.org/mime/-/mime-1.3.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mime/package.json
Dependency Hierarchy: - express-4.13.4.tgz (Root Library) - send-0.13.1.tgz - :x: **mime-1.3.4.tgz** (Vulnerable Library)
Found in HEAD commit: 6c7cc801274c55a47ba8227e24b2d4724302bea1
Found in base branch: master
### Vulnerability DetailsThe mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input. Mend Note: Converted from WS-2017-0330, on 2022-11-08.
Publish Date: 2018-06-07
URL: CVE-2017-16138
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138
Release Date: 2018-04-26
Fix Resolution (mime): 1.4.1
Direct dependency fix Resolution (express): 4.16.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2017-16119
### Vulnerable Library - fresh-0.3.0.tgzHTTP response freshness testing
Library home page: https://registry.npmjs.org/fresh/-/fresh-0.3.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/fresh/package.json
Dependency Hierarchy: - express-4.13.4.tgz (Root Library) - :x: **fresh-0.3.0.tgz** (Vulnerable Library)
Found in HEAD commit: 6c7cc801274c55a47ba8227e24b2d4724302bea1
Found in base branch: master
### Vulnerability DetailsFresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Publish Date: 2018-06-07
URL: CVE-2017-16119
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.npmjs.com/advisories/526
Release Date: 2018-04-26
Fix Resolution (fresh): 0.5.2
Direct dependency fix Resolution (express): 4.15.5
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-10539
### Vulnerable Library - negotiator-0.5.3.tgzHTTP content negotiation
Library home page: https://registry.npmjs.org/negotiator/-/negotiator-0.5.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/negotiator/package.json
Dependency Hierarchy: - express-4.13.4.tgz (Root Library) - accepts-1.2.13.tgz - :x: **negotiator-0.5.3.tgz** (Vulnerable Library)
Found in HEAD commit: 6c7cc801274c55a47ba8227e24b2d4724302bea1
Found in base branch: master
### Vulnerability Detailsnegotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
Publish Date: 2018-05-31
URL: CVE-2016-10539
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.npmjs.com/advisories/106
Release Date: 2018-04-26
Fix Resolution (negotiator): 0.6.1
Direct dependency fix Resolution (express): 4.14.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-29041
### Vulnerable Library - express-4.13.4.tgzFast, unopinionated, minimalist web framework
Library home page: https://registry.npmjs.org/express/-/express-4.13.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/express/package.json
Dependency Hierarchy: - :x: **express-4.13.4.tgz** (Vulnerable Library)
Found in HEAD commit: 6c7cc801274c55a47ba8227e24b2d4724302bea1
Found in base branch: master
### Vulnerability DetailsExpress.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.
Publish Date: 2024-03-25
URL: CVE-2024-29041
### CVSS 3 Score Details (6.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc
Release Date: 2024-03-25
Fix Resolution: 4.19.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.