Debug package version in body parser showing security vulnerability

[MandeeGit]

Debug package version in body parser showing security vulnerability. This need to be updated to latest version of debug package V4.3.4. do we know when this will be updated?

[UlisesGascon]

Thanks for reporting @MandeeGit, but I was not able to find this reference. What software do you use?

I checked against Snyk and Socket.dev:

• https://security.snyk.io/package/npm/debug/2.6.9
• https://security.snyk.io/package/npm/body-parser
• https://socket.dev/npm/package/body-parser/overview/1.20.2

[MandeeGit]

@UlisesGascon I am using Check Marx. By default it is listing in my package-lock.json. Unable to override it.

[UlisesGascon]

Yes, @MandeeGit. debug@2.6.9 is included with body-parser, but I can't see any direct vulnerability associated

No direct vulnerabilities have been found for this package in Snyk’s vulnerability database. This does not include vulnerabilities belonging to this package’s dependencies. Snyk debug@2.6.9

Same results on Socket.dev. Do you have any CVE associated?

AFAIK we are not planning to update to debug@4.3.4 yet.

[MandeeGit]

Please find CWE below @UlisesGascon
CWE - 401 and CWE 1333

[wesleytodd]

@MandeeGit A screenshot of a page is not enough for us to act on. We don't see any reported CVE's on any of the normal platforms and your screenshot is not enough to understand or remediate the issue. If it is not just a false positive on that platform please have them reach out (or do so yourself) with a security report so we can address it.

[ctcpip]

false positive with Checkmarx

it's referencing:

GHSA-gxpj-cx7g-858c

and

debug-js/debug#678 (which I can't find any CVE for)

edit: the memory leak may be a valid vulnerability... but there is no patch the memory leak was fixed here: debug-js/debug#740 in version 4.3.0

[wesleytodd]

Ok, I am going to close this

[ctcpip]

edited my above comment, but the memory leak was patched in 4.3.0 and was not backported

[ctcpip]

worth noting that express itself pulls in the same version of debug

[ctcpip]

good news! the memory leak is NOT present in 2.6.9. PoC here: https://stackblitz.com/edit/stackblitz-starters-dhsr9k?file=index.js

if you run the app there and open up your browser dev tools memory profiler, you'll see that there is no leak. (on my machine total heap was in the 100s of MB)

if you want to reproduce the leak there, then npm i debug@4.1.1 and then run it again. you'll see the heap go up and up