Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use of outdated veunrable busboy #6

Closed
bytebrain opened this issue Oct 4, 2022 · 0 comments
Closed

Use of outdated veunrable busboy #6

bytebrain opened this issue Oct 4, 2022 · 0 comments

Comments

@bytebrain
Copy link

Hi,

First of all, great work on Ostrojs! But the http package makes use of a vulnerable version of busboy. The latest version is 1.6.0 and the vulnerability is solved in 1.0.0.

More info:
mscdex/busboy#250 (comment)

# npm audit report

dicer  *
Severity: high
Crash in HeaderParser in dicer - https://github.com/advisories/GHSA-wm7h-9275-46v2
No fix available
node_modules/dicer
  busboy  <=0.3.1
  Depends on vulnerable versions of dicer
  node_modules/busboy
    @ostro/http  *
    Depends on vulnerable versions of busboy
    node_modules/@ostro/http
      @ostro/foundation  *
      Depends on vulnerable versions of @ostro/http
      node_modules/@ostro/foundation
      @ostro/framework  *
      Depends on vulnerable versions of @ostro/foundation
      Depends on vulnerable versions of @ostro/http
      node_modules/@ostro/framework
# npm list busboy 
@ostro/ostro@1.0.1
└─┬ @ostro/framework@1.0.0
  └─┬ @ostro/http@1.0.4
    └── busboy@0.3.1

Is it possible to update the dependency?
Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants