dbader/node-datadog-metrics

NSP security issue (advisories/534)

kirkstrobeck opened this issue · 2 comments

kirkstrobeck commented

https://nodesecurity.io/advisories/534

$ nsp check 
(+) 1 vulnerabilities found
┌───────────────┬─────────────────────────────────────────────────────────────────┐
│               │ Regular Expression Denial of Service                            │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ Name          │ debug                                                           │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ CVSS          │ 3.7 (Low)                                                       │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ Installed     │ 2.2.0                                                           │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ Vulnerable    │ <= 2.6.8 || >= 3.0.0 <= 3.0.1                                   │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ Patched       │ >= 2.6.9 < 3.0.0 || >= 3.1.0                                    │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ Path          │ frontend@1.11.25 > datadog-metrics@0.4.0 > debug@2.2.0          │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ More Info     │ https://nodesecurity.io/advisories/534                          │
└───────────────┴─────────────────────────────────────────────────────────────────┘

Overview

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Remediation

Upgrade to version 2.6.9 or greater if you are on the 2.6.x series or 3.1.0 or greater.

csabapalfi commented

Fixed in 0.6.1 (Sorry for the version mixup, I accidentally also published 0.5.1 😊 )

  • 👍1