Skip to content

"Regular Expression Denial of Service" security issues on dependencies #4266

Closed
@c3s4r

Description

@c3s4r

Issue Description

Running nsp check using parse-server 2.6.3 launches "Regular Expression Denial of Service" security warnings.

Steps to reproduce

Create a new express application with the parse-server dependency
Add nsp dependency
Run nsp check

Expected Results

Not to show any security warning.

Actual Outcome

The following warnings are displayed:

Regular Expression Denial of Service
@0.0.1 > [email protected] > [email protected]
https://nodesecurity.io/advisories/535

Regular Expression Denial of Service
@0.0.1 > [email protected] > [email protected] > [email protected] > [email protected]
https://nodesecurity.io/advisories/535

Regular Expression Denial of Service
@0.0.1 > [email protected] > [email protected] > [email protected]
https://nodesecurity.io/advisories/526

Regular Expression Denial of Service
@0.0.1 > [email protected] > [email protected] > [email protected]
https://nodesecurity.io/advisories/534

Regular Expression Denial of Service
@0.0.1 > [email protected] > [email protected] > [email protected] > [email protected]
https://nodesecurity.io/advisories/534

Environment Setup

  • Server

    • parse-server version (Be specific! Don't say 'latest'.) : 2.6.3
    • Operating System: MacOSX 10.12.6
    • Hardware: MacBookPro 2013
    • Localhost or remote server? Local
  • Database

    • MongoDB version: 3.4
    • Storage engine: WiredTiger
    • Hardware: MacBookPro 2013
    • Localhost or remote server? Localhost

Logs/Trace

See above in the actual outcome.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions