nth-check vulnerability found in react-scripts@4.0.3

Hi,

I have a dashboard developed in reactjs and from last few days my github has started to display a vulnerability issue in react-scripts@4.0.3 for nth-check dependency.

react-scripts@4.0.3 uses nth-check v1.0.2 where as to resolve the vulnerability issue the recommended version is 2.1.0 or higher.

Remediation
Upgrade nth-check to version 2.0.1 or later. For example:

"dependencies": {
  "nth-check": ">=2.0.1"
}
or…
"devDependencies": {
  "nth-check": ">=2.0.1"
}

CVE-2021-3803
moderate severity
Vulnerable versions: < 2.0.1
Patched version: 2.0.1
nth-check is vulnerable to Inefficient Regular Expression Complexity

Dependabot cannot update nth-check to a non-vulnerable version
The latest possible version that can be installed is 1.0.2 because of the following conflicting dependency:

react-scripts@4.0.3 requires nth-check@^1.0.2 via a transitive dependency on css-select@2.1.0
The earliest fixed version is 2.0.1.

Thanks and Regards, Sandeep

[agkhare]

We are waiting for this vulnerability to be fixed, since long long time. Can someone please provide us an ETA on this one ?

[iiLearner]

Could this be looked into as well? most of other vulnerabilities were fixed in react-scripts 5.0.0 except this one