WS-2019-0314 (Medium) detected in express-fileupload-0.0.5.tgz

[mend-bolt-for-github]

WS-2019-0314 - Medium Severity Vulnerability

Vulnerable Library - express-fileupload-0.0.5.tgz

Simple express file upload middleware that wraps around connect-busboy

Library home page: https://registry.npmjs.org/express-fileupload/-/express-fileupload-0.0.5.tgz

Path to dependency file: /tmp/ws-scm/know-your-SNPs/package.json

Path to vulnerable library: /know-your-SNPs/node_modules/express-fileupload/package.json

Dependency Hierarchy:

• ❌ express-fileupload-0.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 0648125b6d8826f363bffa8befdf03671d621976

Vulnerability Details

There is a Denial of Service vulnerability was found in express-fileupload before1.1.6-alpha.6 if the request contains a large filename of '.' characters.

Publish Date: 2019-10-18

URL: WS-2019-0314

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1216

Release Date: 2019-12-01

Fix Resolution: express-fileupload - 1.1.6-alpha.6

---

Step up your Open Source Security Game with WhiteSource here