Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Node security project failure

See original GitHub issue

Hi, we are getting nsp failures in intercom-node. We are running unirest 0.4.2 which appears to be the latest. There was a change https://github.com/Mashape/unirest-nodejs/commit/dddf899ad0cfbb29aefeab8e278e618811b5e70e to bump the request version but did it get released? And do you think it will fix the hawk issue?

┌───────────────┬───────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│               │ Regular Expression Denial of Service                                                                      │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Name          │ hawk                                                                                                      │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Installed     │ 1.1.1                                                                                                     │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Vulnerable    │ < 3.1.3  || >= 4.0.0 <4.1.1                                                                               │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Patched       │ >=3.1.3 < 4.0.0 || >=4.1.1                                                                                │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Path          │ intercom-client@2.6.0 > unirest@0.4.2 > request@2.51.0 > hawk@1.1.1                                       │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ More Info     │ https://nodesecurity.io/advisories/77                                                                     │
└───────────────┴───────────────────────────────────────────────────────────────────────────────────────────────────────────┘

Issue Analytics

State:
Created 8 years ago
Comments:9 (4 by maintainers)

Top GitHub Comments

1reaction

nijikokuncommented, May 9, 2016

0.5.0 has been released, beware that I have updated all module dependencies to their latest (safe) version that I can foresee. Let me know if you spot any issues.

 % nsp check                                                                                    git/unirest-nodejs (master) nijikokun
(+) No known vulnerabilities found

1reaction

nijikokuncommented, May 9, 2016

today

Top Results From Across the Web

nodesecurity/nsp: node security platform command-line tool

Make use of the CLI tool to help identify known vulnerabilities in your own projects. Get access to Node Security news and information...

Top 10 Node.js Security Best Practices - Risks & Prevention

1.Cross-site scripting (XSS). If a web application fails to adequately validate user input, malicious actors can inject modified JavaScript code into the web ......

Nodejs Security - OWASP Cheat Sheet Series

Input validation failures can result in many different types of application attacks. These include SQL Injection, Cross-Site Scripting, Command Injection, Local ...

Nov 3 2022 Security Releases | Node.js

(Update 04-November-2022) Security releases available ... certificate verification despite failure to construct a path to a trusted issuer.

5 Node.js Security Risks You Cannot Ignore - Medium

Errors or application failures can lead to server turnoffs. The most common Node.js security issues include NPM phishing and regular expressions ...