node-coveralls
node-coveralls copied to clipboard
Moderate severity issue with current sshpk version
See here:
CVE-2018-3737 (moderate severity)
Vulnerable versions: < 1.13.2
Patched version: 1.13.2
The sshpk NPM package is vulnerable to ReDoS when parsing crafted invalid public keys.
Please update this dependency. Thank you.
Since this library doesn't seem to be supported anymore I fix a bunch of things on a fork if you want to check it out and are still pulling the library into your packages: https://github.com/jtwebman/coveralls-next
Good to know @jtwebman . Thank you.