backend NPM Vulnerability Report

## NPM Vulnerability Report - Tuesday, September 17th, 2024
NPM packages have been checked for vulnerabilities using npm audit.

![HIGHEST_SEVERITY]

[HIGHEST_SEVERITY]: https://img.shields.io/badge/highest_severity-high-9e3302?style=for-the-badge

⚠️ - 5 `MODERATE` severity vulnerabilities.
⚠️ - 3 `HIGH` severity vulnerabilities.

---
![@bcgov/citz-imb-endpoint-builder_header]

**Severity**: `moderate`
**Vulnerable Range**: `*`

**Via**:

Expand to see vulnerability details.

Via `express`

**Latest Available Version**: `1.0.0-beta2`

This dependency has a `fix available`, and is a `direct dependency` in your package.json.
See affected dependencies below:

Update `@bcgov/citz-imb-endpoint-builder` to `1.0.0-beta2`.

[@bcgov/citz-imb-endpoint-builder_header]: https://img.shields.io/badge/@bcgov/citz_imb_endpoint_builder-f5c60c?style=for-the-badge

---
![@bcgov/citz-imb-express-utilities_header]

**Severity**: `moderate`
**Vulnerable Range**: `*`

**Via**:

Expand to see vulnerability details.

Via `express`

**Latest Available Version**: `1.0.0-beta`

This dependency has a `fix available`, and is a `direct dependency` in your package.json.
See affected dependencies below:

Update `@bcgov/citz-imb-express-utilities` to `1.0.0-beta`.

[@bcgov/citz-imb-express-utilities_header]: https://img.shields.io/badge/@bcgov/citz_imb_express_utilities-f5c60c?style=for-the-badge

---
![@bcgov/citz-imb-sso-express_header]

**Severity**: `moderate`
**Vulnerable Range**: `*`

**Via**:

Expand to see vulnerability details.

Via `express`

**Latest Available Version**: `1.0.2`

This dependency does `NOT` have a `fix available.`

[@bcgov/citz-imb-sso-express_header]: https://img.shields.io/badge/@bcgov/citz_imb_sso_express-f5c60c?style=for-the-badge

---
![body-parser_header]

**Severity**: `high`
**Vulnerable Range**: `<1.20.3`

**Via**:

Expand to see vulnerability details.

`1`: body-parser vulnerable to denial of service when url encoding is enabled.

**Severity**: `high`
**Vulnerable Range**: `<1.20.3`
**CVSS Score**: `7.5 / 10`
**Weaknesses**: `CWE-405`

[GitHub Advisory](https://github.com/advisories/GHSA-qwcr-r2fm-qrc7)

**Latest Available Version**: `1.20.3`

This dependency has a `fix available`, but `body-parser` is `NOT` a `direct dependency` in your package.json.
See affected dependencies below:

Expand to see direct dependencies affacted by this vulnerability.

- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.

[body-parser_header]: https://img.shields.io/badge/body_parser-9e3302?style=for-the-badge

---
![express_header]

**Severity**: `high`
**Vulnerable Range**: `<=4.19.2 || 5.0.0-alpha.1 - 5.0.0-beta.3`

**Via**:

Expand to see vulnerability details.

`1`: express vulnerable to XSS via response.redirect().

**Severity**: `moderate`
**Vulnerable Range**: `<4.20.0`
**CVSS Score**: `5 / 10`
**Weaknesses**: `CWE-79`

[GitHub Advisory](https://github.com/advisories/GHSA-qw6h-vgh9-j6wx)

Via `body-parser`

Via `path-to-regexp`

Via `send`

Via `serve-static`

**Latest Available Version**: `4.21.0`

This dependency has a `fix available`, and is a `direct dependency` in your package.json.
See affected dependencies below:

Update `express` to `4.21.0`.

[express_header]: https://img.shields.io/badge/express-9e3302?style=for-the-badge

---
![path-to-regexp_header]

**Severity**: `high`
**Vulnerable Range**: `<0.1.10`

**Via**:

Expand to see vulnerability details.

`1`: path-to-regexp outputs backtracking regular expressions.

**Severity**: `high`
**Vulnerable Range**: `<0.1.10`
**CVSS Score**: `7.5 / 10`
**Weaknesses**: `CWE-1333`

[GitHub Advisory](https://github.com/advisories/GHSA-9wv6-86v2-598j)

**Latest Available Version**: `8.1.0`

This dependency has a `fix available`, but `path-to-regexp` is `NOT` a `direct dependency` in your package.json.
See affected dependencies below:

Expand to see direct dependencies affacted by this vulnerability.

- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.

[path-to-regexp_header]: https://img.shields.io/badge/path_to_regexp-9e3302?style=for-the-badge

---
![send_header]

**Severity**: `moderate`
**Vulnerable Range**: `<0.19.0`

**Via**:

Expand to see vulnerability details.

`1`: send vulnerable to template injection that can lead to XSS.

**Severity**: `moderate`
**Vulnerable Range**: `<0.19.0`
**CVSS Score**: `5 / 10`
**Weaknesses**: `CWE-79`

[GitHub Advisory](https://github.com/advisories/GHSA-m6fv-jmcg-4jfg)

**Latest Available Version**: `0.19.0`

This dependency has a `fix available`, but `send` is `NOT` a `direct dependency` in your package.json.
See affected dependencies below:

Expand to see direct dependencies affacted by this vulnerability.

- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.

- Direct dependency `cors` does NOT have a fix available.

- Direct dependency `express` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `express` available.

Update from version `4.19.2` to `4.21.0`.

- Direct dependency `typeorm` does NOT have a fix available.

- Direct dependency `zod` does NOT have a fix available.

- Direct dependency `@types/node` may have a fix available because one of it's nested child dependencies fixes the vulnerability and there is a new version of `@types/node` available.

Update from version `20.14.5` to `22.5.5`.

[send_header]: https://img.shields.io/badge/send-f5c60c?style=for-the-badge

---
![serve-static_header]

**Severity**: `moderate`
**Vulnerable Range**: `<=1.16.0`

**Via**:

Expand to see vulnerability details.

`1`: serve-static vulnerable to template injection that can lead to XSS.

**Severity**: `moderate`
**Vulnerable Range**: `<1.16.0`
**CVSS Score**: `5 / 10`
**Weaknesses**: `CWE-79`

[GitHub Advisory](https://github.com/advisories/GHSA-cm22-4g7w-348p)

Via `send`

**Latest Available Version**: `1.16.2`

This dependency has a `fix available`, but `serve-static` is `NOT` a `direct dependency` in your package.json.
See affected dependencies below:

Expand to see direct dependencies affacted by this vulnerability.

- Direct dependency `express` has a fix available. Install version `4.21.0` of `express`.

[serve-static_header]: https://img.shields.io/badge/serve_static-f5c60c?style=for-the-badge