JKHeadley / JKHeadley/rest-hapi
Security vulnerability in rest-hapi > loggin > glob > minimatch, modules needs updating
- Dominant language
- JavaScript
- Stars
- 1.2k
- Forks
- 155
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
There is a module that needs updating in order to patch a vulnerability
**Additional context**
```
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ minimatch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.0.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ rest-hapi │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ rest-hapi > loggin > glob > minimatch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/118 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```
Additionally I would recommend setting up https://snyk.io/ or similar to automatically get PRs with fixes for such vulns.
Contributor guide
Research direction
Start by tracing the rest-hapi > loggin > glob > minimatch dependency path in the project’s dependency manifest. Update minimatch to a patched version (>=3.0.2) and verify that the vulnerable dependency is no longer present; consider the linked Snyk recommendation for automated vulnerability fixes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100