Node Security Project advisory against jade -> uglify-js package <2.6.0
- Dominant language
- JavaScript
- Stars
- 9.4k
- Forks
- 858
- PR merge metrics
- No merged PRs in 30d
Description
nsp is has flagged an issue with your version of jade -> uglify-js, consider updating it. Here is the report.
```
┌───────────────┬────────────────────────────────────────────┐
│ │ Regular Expression Denial of Service │
├───────────────┼────────────────────────────────────────────┤
│ Name │ uglify-js │
├───────────────┼────────────────────────────────────────────┤
│ Installed │ 2.2.5 │
├───────────────┼────────────────────────────────────────────┤
│ Vulnerable │ <2.6.0 │
├───────────────┼────────────────────────────────────────────┤
│ Patched │ >=2.6.0 │
├───────────────┼────────────────────────────────────────────┤
│ Path │ kue > jade > transformers > uglify-js │
├───────────────┼────────────────────────────────────────────┤
│ More Info │ https://nodesecurity.io/advisories/48 │
└───────────────┴────────────────────────────────────────────┘
┌───────────────┬────────────────────────────────────────────┐
│ │ Incorrect Handling of Non-Boolean Compari… │
├───────────────┼────────────────────────────────────────────┤
│ Name │ uglify-js │
├───────────────┼────────────────────────────────────────────┤
│ Installed │ 2.2.5 │
├───────────────┼────────────────────────────────────────────┤
│ Vulnerable │ <= 2.4.23 │
├───────────────┼────────────────────────────────────────────┤
│ Patched │ >= 2.4.24 │
├───────────────┼────────────────────────────────────────────┤
│ Path │ kue > jade > transformers > uglify-js │
├───────────────┼────────────────────────────────────────────┤
│ More Info │ https://nodesecurity.io/advisories/39 │
└───────────────┴────────────────────────────────────────────┘
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with Node Security advisories 48 and 39, then trace the reported kue > jade > transformers > uglify-js path to find where version 2.2.5 is selected. Update the dependency chain to a patched version and verify that the installed uglify-js no longer matches either vulnerable range.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100