googleapis / googleapis/google-cloud-node
Vulnerability: debug package
Open
library: google-cloud-node-core
priority: p2
type: bug
- Dominant language
- TypeScript
- Stars
- 3.2k
- Forks
- 712
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 99
Description
Hi ! There a vulnerability identified by GitHub on debug package.
In fact, there are a ReDoS vulnerability on < 4.3.1 versions.
Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.
As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.
This was later re-introduced in version v3.2.0, and then repatched in versions 3.2.7 and 4.3.1.
You have more infos here : https://github.com/advisories/GHSA-gxpj-cx7g-858c
Do you think that you can update your package.json file in consequence ?
Contributor guide
Assessment
This issue has not been assessed yet.