deepkit-framework
deepkit-framework copied to clipboard
Upgrade vulnerable package selfsigned
After installing @deepkit/framework
:
$ npm audit
# npm audit report
node-forge <=1.2.1
Severity: high
Open Redirect in node-forge - https://github.com/advisories/GHSA-8fr3-hfg3-gpgp
Prototype Pollution in node-forge debug API. - https://github.com/advisories/GHSA-5rrq-pxf6-6jx5
Improper Verification of Cryptographic Signature in `node-forge` - https://github.com/advisories/GHSA-2r2c-g63r-vccr
Improper Verification of Cryptographic Signature in node-forge - https://github.com/advisories/GHSA-x4jg-mjrx-434g
Improper Verification of Cryptographic Signature in node-forge - https://github.com/advisories/GHSA-cfm4-qjh2-4765
URL parsing in node-forge could lead to undesired behavior. - https://github.com/advisories/GHSA-gf8q-jrpm-jvxq
The report also mentions that @deepkit/framework
depends on vulnerable versions of selfsigned
(1.1.1 - 1.10.14) which in turn depend on vulnerable versions of node-forge
(<=1.2.1).
It seems that a simple way to resolve this issue would be to upgrade the selfsigned
library to its latest version 2.1.1
.