Skip to content
This repository was archived by the owner on Aug 18, 2020. It is now read-only.

Upgrade jsonwebtoken dependency to fix vulnerability #18

Closed
gianpaj opened this issue Jul 21, 2018 · 1 comment
Closed

Upgrade jsonwebtoken dependency to fix vulnerability #18

gianpaj opened this issue Jul 21, 2018 · 1 comment

Comments

@gianpaj
Copy link

gianpaj commented Jul 21, 2018

What?

❌ High severity vulnerability found in base64url
Description: Uninitialized Memory Exposure
Info: https://snyk.io/vuln/npm:base64url:20180511
Introduced through: @pusher/[email protected]
From: @pusher/[email protected] > [email protected] > [email protected] > [email protected]
From: @pusher/[email protected] > [email protected] > [email protected] > [email protected] > [email protected]
From: @pusher/[email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected]
and 3 more...
Remediation:
~~Your dependencies are out of date, otherwise you would be using a newer version of base64url.
Try deleting node_modules, reinstalling and running snyk test again. If the problem persists,~~~ one of your dependencies may be bundling outdated modules.

Suggested improvements

They fixed it this PR:
auth0/node-jsonwebtoken#465

@hamchapman
Copy link
Contributor

Published 0.12.2 that fixes this - thanks!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants