terribleplan/next.js
1
0
Fork 0
mirror of https://github.com/terribleplan/next.js.git synced 2024-01-19 02:48:18 +00:00
Code Issues Releases Wiki Activity

Update exposed package to avoid DoS (#3080)

Browse source 
Running nsp check

```
➜  web git:(master) nsp check
(+) 1 vulnerabilities found
┌───────────────┬────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│               │ Regular Expression Denial of Service                                                                       │
├───────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Name          │ mime                                                                                                       │
├───────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ CVSS          │ 7.5 (High)                                                                                                 │
├───────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Installed     │ 1.3.4                                                                                                      │
├───────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Vulnerable    │ < 1.4.1 || > 2.0.0 < 2.0.3                                                                                 │
├───────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Patched       │ >= 1.4.1 < 2.0.0 || >= 2.0.3                                                                               │
├───────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Path          │ web@1.0.0 > next@4.0.1 > send@0.15.6 > mime@1.3.4                                                          │
├───────────────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ More Info     │ https://nodesecurity.io/advisories/535                                                                     │
└───────────────┴────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

```

This is a dependency of send which already upgraded this in order to not be exposed to this known error.
https://github.com/pillarjs/send/blob/master/HISTORY.md
This commit is contained in:
Tomas Roos 2017-10-14 23:52:15 +02:00 committed by Tim Neutkens
parent 8711a7d14e
commit 494f416a9f
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
package.json
View file

@ -88,7 +88,7 @@
"prop-types-exact": "1.1.1",
"react-hot-loader": "^3.0.0",
"recursive-copy": "2.0.6",
"send": "0.15.6",
"send": "0.16.1",
"source-map-support": "0.4.18",
"strip-ansi": "4.0.0",
"styled-jsx": "2.0.2",