Description
Vulnerable Library - koa-body-6.0.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/formidable/node_modules/qs/package.json
Found in HEAD commit: 5b136f827bd8d8ae6e2b8902c5833e7d7c211fa8
Vulnerabilities
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in (koa-body version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2023-4316 |  High |
7.5 | zod-3.19.1.tgz | Transitive | N/A* | ❌ |
| CVE-2022-24999 | High |
7.5 | qs-6.9.3.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-4316
Vulnerable Library - zod-3.19.1.tgz
TypeScript-first schema declaration and validation library with static type inference
Library home page: https://registry.npmjs.org/zod/-/zod-3.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/zod/package.json
Dependency Hierarchy:
- koa-body-6.0.1.tgz (Root Library)
- ❌ zod-3.19.1.tgz (Vulnerable Library)
Found in HEAD commit: 5b136f827bd8d8ae6e2b8902c5833e7d7c211fa8
Found in base branch: main
Vulnerability Details
Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.
Publish Date: 2023-09-28
URL: CVE-2023-4316
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-mvrp-3cvx-c325
Release Date: 2023-09-28
Fix Resolution: zod - 3.22.3
CVE-2022-24999
Vulnerable Library - qs-6.9.3.tgz
A querystring parser that supports nesting and arrays, with a depth limit
Library home page: https://registry.npmjs.org/qs/-/qs-6.9.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/formidable/node_modules/qs/package.json
Dependency Hierarchy:
- koa-body-6.0.1.tgz (Root Library)
- formidable-2.0.1.tgz
- ❌ qs-6.9.3.tgz (Vulnerable Library)
- formidable-2.0.1.tgz
Found in HEAD commit: 5b136f827bd8d8ae6e2b8902c5833e7d7c211fa8
Found in base branch: main
Vulnerability Details
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).
Publish Date: 2022-11-26
URL: CVE-2022-24999
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999
Release Date: 2022-11-26
Fix Resolution: qs - 6.2.4,6.3.3,6.4.1,6.5.3,6.6.1,6.7.3,6.8.3,6.9.7,6.10.3