search

twilio / twilio-node

Node.js helper library
MIT License
1.37k stars 495 forks source link

[Vulnerability] patch axios vulnerability CVE-2023-26159 #992

Closed lilfaf closed 2 months ago

lilfaf commented 6 months ago

Issue Summary

The library uses axios 1.6.0 which has a vulnerable dependency with follow-redirects < 1.15.4

https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137

See related PRs on axios: https://github.com/axios/axios/issues/6164 https://github.com/axios/axios/issues/6166

Steps to Reproduce

Code Snippet

snyk test --all-projects

Exception/Log

Issues to fix by upgrading:

  Upgrade axios@1.6.0 to axios@1.6.3 to fix
  ✗ Regular Expression Denial of Service (ReDoS) (new) [Medium Severity][https://security.snyk.io/vuln/SNYK-JS-AXIOS-6124857] in axios@1.6.0
    introduced by axios@1.6.0 and 1 other path(s)

Issues with no direct upgrade or patch:
  ✗ Improper Input Validation [High Severity][https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137] in follow-redirects@1.15.2
    introduced by axios@1.6.0 > follow-redirects@1.15.2 and 1 other path(s)
  This issue was fixed in versions: 1.15.4

Technical details:

tiwarishubham635 commented 2 months ago

Resolved by #993