This library includes a security vulnerability
- Dominant language
- JavaScript
- Stars
- 1.7k
- Forks
- 283
- PR merge metrics
- No merged PRs in 30d
Description
I'm using a tool from the [Node Security Project](https://nodesecurity.io/) called [`nsp`](https://www.npmjs.com/package/nsp) to check for security vulnerabilities.
It looks like this would be fixed by using the latest version of [`debug`](https://www.npmjs.com/package/debug) .
```
~/knox (master) $ nsp check
(+) 1 vulnerabilities found
┌───────────────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Name │ ms │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Installed │ 0.6.2 │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Vulnerable │ <=0.7.0 │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Patched │ >0.7.0 │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Path │ debug > ms │
├───────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ More Info │ https://nodesecurity.io/advisories/46 │
└───────────────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
```
Contributor guide
No contributing guide indexed for this repository
Research direction
No source file or test is named. Start by running the reported nsp check and inspect where debug is declared as a dependency; update it so the installed ms version is above 0.7.0, then rerun the check and confirm the advisory is gone.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100