Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency express to ^4.21.2 #53

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update dependency express to ^4.21.2 #53

wants to merge 1 commit into from

Conversation

mend-for-jackfan.us.kg[bot]
Copy link

This PR contains the following updates:

Package Type Update Change
express (source) dependencies minor ^4.17.1 -> ^4.21.2

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity CVSS Score CVE
High High 7.5 CVE-2024-52798
Medium Medium 5.3 CVE-2024-47764

Release Notes

expressjs/express (express)

v4.21.2

Compare Source

What's Changed

Full Changelog: expressjs/express@4.21.1...4.21.2

v4.21.1

Compare Source

What's Changed

Full Changelog: expressjs/express@4.21.0...4.21.1

v4.21.0

Compare Source

What's Changed

New Contributors

Full Changelog: expressjs/express@4.20.0...4.21.0

v4.20.0

Compare Source

==========

  • deps: [email protected]
    • Remove link renderization in html while redirecting
  • deps: [email protected]
    • Remove link renderization in html while redirecting
  • deps: [email protected]
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: [email protected]
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

v4.19.2

Compare Source

==========

  • Improved fix for open redirect allow list bypass

v4.19.1

Compare Source

==========

  • Allow passing non-strings to res.location with new encoding handling checks

v4.19.0

Compare Source

==========

v4.18.3

Compare Source

==========

v4.18.2

Compare Source

===================

v4.18.1

Compare Source

===================

  • Fix hanging on large stack of sync routes

v4.18.0

Compare Source

===================

v4.17.3

Compare Source

===================

v4.17.2

Compare Source

===================

  • If you want to rebase/retry this PR, check this box

@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot added the security fix Security fix generated by Mend label Feb 25, 2025
@socket-security Socket Security
Copy link

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher

🚮 Removed packages: npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

@rafikmojr
Copy link

Logo
Checkmarx One – Scan Summary & Details – fa8cd9fc-2354-472c-b870-ad4d3c87cf81

New Issues (19)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL CVE-2024-48949 Npm-elliptic-6.5.4
detailsRecommended version: 6.6.1
Description: The verify function in "lib/elliptic/eddsa/index.js" in the Elliptic versions 4.0.0 through 6.5.5 for Node.js omits "sig.S().gte(sig.eddsa.curve.n)...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL Cx88b46a98-47a5 Npm-elliptic-6.5.4
detailsRecommended version: 6.6.1
Description: The elliptic package is a plain JavaScript implementation of elliptic-curve cryptography. Versions of elliptic package prior to 6.6.1 are vulnerabl...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
CRITICAL MongoDB_NoSQL_Injection /routes/showProductReviews.ts: 30
detailsThe application relies on user inputs provided in id in /routes/showProductReviews.ts at line 30 to construct a raw MongoDB query with id in /route...
Attack Vector
CRITICAL MongoDB_NoSQL_Injection /routes/trackOrder.ts: 15
detailsThe application relies on user inputs provided in id in /routes/trackOrder.ts at line 15 to construct a raw MongoDB query with id in /routes/trackO...
Attack Vector
CRITICAL MongoDB_NoSQL_Injection /routes/trackOrder.ts: 15
detailsThe application relies on user inputs provided in id in /routes/trackOrder.ts at line 15 to construct a raw MongoDB query with id in /routes/trackO...
Attack Vector
CRITICAL Stored_XSS /routes/userProfile.ts: 76
detailsThe method Lambda embeds untrusted data in generated output with send, at line 65 of /routes/userProfile.ts. This untrusted data is embedded into t...
Attack Vector
CRITICAL Stored_XSS /routes/videoHandler.ts: 79
detailsThe method Lambda embeds untrusted data in generated output with send, at line 70 of /routes/videoHandler.ts. This untrusted data is embedded into ...
Attack Vector
CRITICAL Stored_XSS /routes/videoHandler.ts: 74
detailsThe method Lambda embeds untrusted data in generated output with send, at line 70 of /routes/videoHandler.ts. This untrusted data is embedded into ...
Attack Vector
CRITICAL Stored_XSS /routes/userProfile.ts: 55
detailsThe method Lambda embeds untrusted data in generated output with send, at line 65 of /routes/userProfile.ts. This untrusted data is embedded into t...
Attack Vector
HIGH Angular_Client_DOM_XSS /frontend/src/app/search-result/search-result.component.ts: 144
detailsThe method search_result_component embeds untrusted data in generated output with searchValue, at line 13 of /frontend/src/app/search-result/search...
Attack Vector
MEDIUM CVE-2024-11831 Npm-serialize-javascript-5.0.1
detailsRecommended version: 6.0.2
Description: A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain i...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
MEDIUM CVE-2024-36751 Npm-parseuri-0.0.6
detailsDescription: An issue in parse-uri and parseuri allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
MEDIUM CVE-2024-47764 Npm-cookie-0.4.2
detailsRecommended version: 0.7.0
Description: The NPM package cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cook...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
MEDIUM CVE-2024-55565 Npm-nanoid-3.1.20
detailsRecommended version: 3.3.8
Description: The package nanoid versions through 3.3.7 and 4.0.0 through 5.0.8 mishandle non-integer values.
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
MEDIUM Cxbb85e86c-2fac Npm-esbuild-wasm-0.17.8
detailsRecommended version: 0.25.0
Description: esbuild is an extremely fast bundler for the web, allowing any website to send any request to the development server and read the response due to d...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
MEDIUM Cxbb85e86c-2fac Npm-esbuild-0.17.8
detailsRecommended version: 0.25.0
Description: esbuild is an extremely fast bundler for the web, allowing any website to send any request to the development server and read the response due to d...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
MEDIUM Privacy_Violation /routes/wallet.ts: 27
detailsMethod Lambda at line 27 of /routes/wallet.ts sends user information outside the application. This may constitute a Privacy Violation.
Attack Vector
LOW CVE-2024-48948 Npm-elliptic-6.5.4
detailsRecommended version: 6.6.1
Description: The Elliptic package versions through 6.5.7 for Node.js, in their ECDSA implementation, do not correctly verify valid signatures if the hash contai...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
LOW Use_Of_Hardcoded_Password /frontend/src/app/register/register.component.spec.ts: 136
detailsThe application uses the hard-coded password "aaaaa" for authentication purposes, either using it to verify users' identities, or to access another...
Attack Vector
Fixed Issues (2004)

Great job! The following issues were fixed in this Pull Request

Severity Issue Source File / Package
CRITICAL Code_Injection /routes/showProductReviews.ts: 30
CRITICAL Code_Injection /routes/trackOrder.ts: 15
CRITICAL Code_Injection /routes/trackOrder.ts: 15
CRITICAL Code_Injection /routes/showProductReviews.ts: 30
CRITICAL Code_Injection /routes/trackOrder.ts: 15
CRITICAL Code_Injection /routes/trackOrder.ts: 15
CRITICAL Code_Injection /routes/trackOrder.ts: 15
CRITICAL Code_Injection /routes/trackOrder.ts: 15
CRITICAL Code_Injection /routes/showProductReviews.ts: 30
CRITICAL Code_Injection /routes/trackOrder.ts: 15
CRITICAL Code_Injection /routes/trackOrder.ts: 15
CRITICAL Code_Injection /routes/showProductReviews.ts: 30
CRITICAL Code_Injection /routes/trackOrder.ts: 15
CRITICAL Code_Injection /routes/showProductReviews.ts: 30
CRITICAL Code_Injection /routes/trackOrder.ts: 15
CRITICAL Cxf6e7f2c1-dc59 Npm-yauzl-2.10.0
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 28
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 80
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 80
CRITICAL Stored_XSS /routes/vulnCodeSnippet.ts: 94
CRITICAL Stored_XSS /routes/search.ts: 24
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_3.ts: 12
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_3.ts: 11
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_2_correct.ts: 8
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_2_correct.ts: 8
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_1.ts: 7
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_1.ts: 6
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 28
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 80
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 80
CRITICAL Stored_XSS /routes/vulnCodeSnippet.ts: 94
CRITICAL Stored_XSS /routes/search.ts: 24
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_3.ts: 12
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_3.ts: 11
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_2_correct.ts: 8
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_2_correct.ts: 8
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_1.ts: 7
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_1.ts: 6
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_2_correct.ts: 8
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 80
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_3.ts: 12
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_1.ts: 7
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_3.ts: 11
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 80
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 28
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_1.ts: 6
CRITICAL Stored_XSS /routes/search.ts: 24
CRITICAL Stored_XSS /routes/vulnCodeSnippet.ts: 94
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_2_correct.ts: 8
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 28
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_1.ts: 7
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 80
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_1.ts: 6
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_2_correct.ts: 8
CRITICAL Stored_XSS /routes/search.ts: 24
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 80
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_3.ts: 11
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_2_correct.ts: 8
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_3.ts: 12
CRITICAL Stored_XSS /routes/vulnCodeSnippet.ts: 94
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_1.ts: 6
CRITICAL Stored_XSS /data/static/codefixes/loginAdminChallenge_1.ts: 21
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_1.ts: 7
CRITICAL Stored_XSS /routes/vulnCodeSnippet.ts: 94
CRITICAL Stored_XSS /routes/search.ts: 24
CRITICAL Stored_XSS /data/static/codefixes/loginBenderChallenge_1.ts: 21
CRITICAL Stored_XSS /data/static/codefixes/loginJimChallenge_4.ts: 21
CRITICAL Stored_XSS /data/static/codefixes/loginAdminChallenge_1.ts: 21
CRITICAL Stored_XSS /data/static/codefixes/dbSchemaChallenge_3.ts: 12
CRITICAL Stored_XSS /routes/login.ts: 37
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 80
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 28
CRITICAL Stored_XSS /data/static/codefixes/loginBenderChallenge_1.ts: 21
CRITICAL Stored_XSS /data/static/codefixes/loginJimChallenge_4.ts: 21
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_2_correct.ts: 8
CRITICAL Stored_XSS /routes/login.ts: 37
CRITICAL Stored_XSS /routes/vulnCodeFixes.ts: 80
CRITICAL Stored_XSS /data/static/codefixes/unionSqlInjectionChallenge_3.ts: 11

More results are available on the CxOne platform

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
security fix Security fix generated by Mend
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@rafikmojr