[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:5.0.0
        └─ eslint-config-react-app:7.0.0
              └─ eslint-plugin-import:2.25.3
                    └─ debug:2.6.9
        └─ react-dev-utils:12.0.0
              └─ detect-port-alt:1.1.6
                    └─ debug:2.6.9
        └─ webpack-dev-server:4.7.2
              └─ compression:1.7.4
                    └─ debug:2.6.9
              └─ express:4.17.2
                    └─ body-parser:1.19.1
                          └─ debug:2.6.9
                    └─ debug:2.6.9
                    └─ finalhandler:1.1.2
                          └─ debug:2.6.9
                    └─ send:0.17.2
                          └─ debug:2.6.9
              └─ serve-index:1.9.1
                    └─ debug:2.6.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Start by inspecting the project’s dependency manifest and lockfile, then trace the listed react-scripts, eslint-config-react-app, react-dev-utils, webpack-dev-server, and express dependency paths. Run the project’s dependency audit to confirm the debug:2.6.9 finding. Done means the vulnerable transitive dependency is no longer installed and the application still builds and runs.