[Snyk] Upgrade: , dotenv, express, express-rate-limit, express-session, helmet, moment, mongoose, nodemailer, pdfkit, ws #1151

FaroukAmr · 2024-09-21T09:59:10Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@vonage/server-sdk
from 3.0.0 to 3.16.0 | 48 versions ahead of your current version | 2 months ago
on 2024-07-25
dotenv
from 16.0.3 to 16.4.5 | 17 versions ahead of your current version | 7 months ago
on 2024-02-20
express
from 4.18.2 to 4.19.2 | 4 versions ahead of your current version | 6 months ago
on 2024-03-25
express-rate-limit
from 6.6.0 to 6.11.2 | 10 versions ahead of your current version | a year ago
on 2023-09-12
express-session
from 1.17.3 to 1.18.0 | 1 version ahead of your current version | 8 months ago
on 2024-01-28
helmet
from 6.0.0 to 6.2.0 | 8 versions ahead of your current version | a year ago
on 2023-05-06
moment
from 2.29.4 to 2.30.1 | 2 versions ahead of your current version | 9 months ago
on 2023-12-27
mongoose
from 6.7.2 to 6.13.0 | 36 versions ahead of your current version | 3 months ago
on 2024-06-06
nodemailer
from 6.8.0 to 6.9.14 | 15 versions ahead of your current version | 3 months ago
on 2024-06-19
pdfkit
from 0.13.0 to 0.15.0 | 2 versions ahead of your current version | 6 months ago
on 2024-03-24
ws
from 8.11.0 to 8.18.0 | 12 versions ahead of your current version | 3 months ago
on 2024-07-03

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Prototype Pollution SNYK-JS-MONGOOSE-5777721	424	Proof of Concept
Denial of Service (DoS) SNYK-JS-WS-7266574	424	Proof of Concept
Use of Weak Hash SNYK-JS-CRYPTOJS-6028119	424	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-FASTXMLPARSER-5668858	424	No Known Exploit
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	424	Proof of Concept
Information Exposure SNYK-JS-MONGODB-5871303	424	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-NODEMAILER-6219989	424	Proof of Concept
Open Redirect SNYK-JS-EXPRESS-6474509	424	No Known Exploit
Prototype Pollution SNYK-JS-FASTXMLPARSER-3325616	424	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-FASTXMLPARSER-7573289	424	No Known Exploit
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	424	Proof of Concept

Release notes

Package name: @vonage/server-sdk

3.16.0 - 2024-07-25
3.15.1 - 2024-07-23
3.15.0 - 2024-07-01
3.14.2 - 2024-06-20
3.14.1 - 2024-05-21
3.14.0 - 2024-03-21
3.13.1 - 2024-02-21
3.12.2 - 2024-01-23
3.12.1 - 2024-01-17
3.12.0 - 2024-01-11
3.11.0 - 2023-12-11
3.10.2 - 2023-12-05
3.10.0 - 2023-10-13
3.9.3 - 2023-09-11
3.9.2 - 2023-08-31
3.9.1 - 2023-08-21
3.8.1 - 2023-08-15
3.8.0 - 2023-08-14
3.7.2 - 2023-08-07
3.7.1 - 2023-08-07
3.7.0 - 2023-08-02
3.6.0 - 2023-06-26
3.5.1 - 2023-05-24
3.5.0 - 2023-05-23
3.4.0 - 2023-05-01
3.3.0 - 2023-04-12
3.2.0 - 2023-03-10
3.1.2 - 2023-03-06
3.1.1 - 2023-03-02
3.1.0 - 2023-03-02
3.0.20 - 2023-02-27
3.0.19 - 2023-02-27
3.0.18 - 2023-01-12
3.0.16 - 2023-01-12
3.0.15 - 2023-01-10
3.0.14 - 2023-01-05
3.0.13 - 2023-01-05
3.0.12 - 2022-12-16
3.0.11 - 2022-12-14
3.0.10 - 2022-11-30
3.0.9 - 2022-11-23
3.0.8 - 2022-11-23
3.0.6 - 2022-11-22
3.0.5 - 2022-11-22
3.0.4 - 2022-11-18
3.0.3 - 2022-11-17
3.0.2 - 2022-11-16
3.0.1 - 2022-11-10
3.0.0 - 2022-11-09

from @vonage/server-sdk GitHub release notes

Package name: dotenv

from dotenv GitHub release notes

Package name: express

4.19.2 - 2024-03-25
4.19.1 - 2024-03-20
What's Changed
- Fix ci after location patch by @ wesleytodd in #5552
- fixed un-edited version in history.md for 4.19.0 by @ wesleytodd in #5556
Full Changelog: 4.19.0...4.19.1
4.19.0 - 2024-03-20
What's Changed
- fix typo in release date by @ UlisesGascon in #5527
- docs: nominating @ wesleytodd to be project captian by @ wesleytodd in #5511
- docs: loosen TC activity rules by @ wesleytodd in #5510
- Add note on how to update docs for new release by @ crandmck in #5541
- Prevent open redirect allow list bypass due to encodeurl
- Release 4.19.0 by @ wesleytodd in #5551
New Contributors
- @ crandmck made their first contribution in #5541
Full Changelog: 4.18.3...4.19.0
4.18.3 - 2024-02-29
Main Changes
- Fix routing requests without method
- deps: [email protected]
  - Fix strict json error message on Node.js 19+
  - deps: content-type@~1.0.5
  - deps: [email protected]
Other Changes
- Use https: protocol instead of deprecated git: protocol by @ vcsjones in #5032
- build: [email protected] and [email protected] by @ abenhamdine in #5034
- ci: update actions/checkout to v3 by @ armujahid in #5027
- test: remove unused function arguments in params by @ raksbisht in #5124
- Remove unused originalIndex from acceptParams by @ raksbisht in #5119
- Fixed typos by @ raksbisht in #5117
- examples: remove unused params by @ raksbisht in #5113
- fix: parameter str is not described in JSDoc by @ raksbisht in #5130
- fix: typos in History.md by @ raksbisht in #5131
- build : add [email protected] by @ abenhamdine in #5028
- test: remove unused function arguments in params by @ raksbisht in #5137
- use random port in test so it won't fail on already listening by @ rluvaton in #5162
- tests: use cb() instead of done() by @ kristof-low in #5233
- examples: remove multipart example by @ riddlew in #5195
- Update support Node.js@18 in the CI by @ UlisesGascon in #5490
- Fix favicon-related bug in cookie-sessions example by @ DmytroKondrashov in #5414
- Release 4.18.3 by @ UlisesGascon in #5505
New Contributors
- @ vcsjones made their first contribution in #5032
- @ abenhamdine made their first contribution in #5034
- @ armujahid made their first contribution in #5027
- @ raksbisht made their first contribution in #5124
- @ rluvaton made their first contribution in #5162
- @ kristof-low made their first contribution in #5233
- @ riddlew made their first contribution in #5195
- @ DmytroKondrashov made their first contribution in #5414
Full Changelog: 4.18.2...4.18.3
4.18.2 - 2022-10-08
- Fix regression routing a large stack in a single route
- deps: [email protected]
  - deps: [email protected]
  - perf: remove unnecessary object clone
- deps: [email protected]

from express GitHub release notes

Package name: express-rate-limit

6.11.2 - 2023-09-12
Fixed
- Restored IncrementResponse TypeScript type (See #397)
6.11.1 - 2023-09-10
Fixed
- Check for prefixed keys when validating that the stores have single counted keys (See #395).
6.11.0 - 2023-09-06
Added
- Support for retrieving the current hit count and reset time for a given key from a store (See #390).
6.10.0 - 2023-08-30
Added
- Support for combined RateLimit header from the RateLimit header fields for HTTP standardization draft adopted by the IETF. Enable by setting standardHeaders: 'draft-7'
- New standardHeaders: 'draft-6' option, treated equivalent to standardHeaders: true from previous releases. (true and false are still supported.)
- New RateLimit-Policy header added when standardHeaders is set to 'draft-6', 'draft-7', or true
- Warning when using deprecated draft_polli_ratelimit_headers option
- Warning when using deprecated onLimitReached option
- Warning when totalHits value returned from Store is invalid
6.9.0 - 2023-08-06
Added
- New validaion check for double-counted requests
- Added help link to each ValidationError, directing users to the appropriate wiki page for more info
Changed
- Miscaleanous documenation improvements
You can view the full changelog here.
6.8.1 - 2023-07-27
Changed
- Revert 6.7.1 change that bumped typescript from 5.x to 4.x and dts-bundle-generator from 8.x to 7.x (See #360)
You can view the full changelog here.
6.8.0 - 2023-07-21
Added
- Added a set of validation checks that will log an error if failed. See
  https://github.com/express-rate-limit/express-rate-limit/wiki/Error-Codes for
  a list of potential errors. Can be disabled by setting validate: false in
  the configuration. Automatically disables after the first request. (See
  #358)
You can view the changelog here.
6.7.2 - 2023-07-27
(Backport of v6.8.1)

You can view the full changelog here.
6.7.1 - 2023-07-06
Fixed
- Fixed compatibility with TypeScript's TypeScript new node16 module
  resolution strategy (See
  #355)
Changed
- Bumped development dependencies.
- Added node 20 to list of versions the CI jobs run on.
No functional changes.

You can view the changelog here.
6.7.0 - 2022-11-15

No functional changes.

Changed
- Updated links to point to the new express-rate-limit organization on GitHub.
- Added advertisement to readme.md for project sponsor Zuplo.
- Updated to typescript version 5 and bumped other dependencies.
- Dropped node 12, and added node 19 to the list of versions the CI jobs run on.
You can view the changelog here.
6.6.0 - 2022-09-04

from express-rate-limit GitHub release notes

Package name: express-session

1.18.0 - 2024-01-28
- Add debug log for pathname mismatch
- Add partitioned to cookie options
- Add priority to cookie options
- Fix handling errors from setting cookie
- Support any type in secret that crypto.createHmac supports
- deps: [email protected]
  - Fix expires option to reject invalid dates
  - perf: improve default decode speed
  - perf: remove slow string split in parse
- deps: [email protected]
1.17.3 - 2022-05-11
- Fix resaving already-saved new session at end of request
- deps: [email protected]

from express-session GitHub release notes

Package name: helmet

from helmet GitHub release notes

Package name: moment

2.30.1 - 2023-12-27
2.30.1
2.30.0 - 2023-12-26
2.30.0
2.29.4 - 2022-07-06
2.29.4

from moment GitHub release notes

Package name: mongoose

6.13.0 - 2024-06-06
6.12.9 - 2024-05-24
6.12.8 - 2024-04-10
6.12.7 - 2024-03-01
6.12.6 - 2024-01-22
6.12.5 - 2024-01-03
6.12.4 - 2023-12-27
6.12.3 - 2023-11-07
6.12.2 - 2023-10-25
6.12.1 - 2023-10-12
6.12.0 - 2023-08-24
6.11.6 - 2023-08-21
6.11.5 - 2023-08-01
6.11.4 - 2023-07-17
6.11.3 - 2023-07-11
6.11.2 - 2023-06-08
6.11.1 - 2023-05-08
6.11.0 - 2023-05-01
6.10.5 - 2023-04-06
6.10.4 - 2023-03-21
6.10.3 - 2023-03-13
6.10.2 - 2023-03-07
6.10.1 - 2023-03-03
6.10.0 - 2023-02-22
6.9.3 - 2023-02-22
6.9.2 - 2023-02-16
6.9.1 - 2023-02-06
6.9.0 - 2023-01-25
6.8.4 - 2023-01-17
6.8.3 - 2023-01-06
6.8.2 - 2022-12-28
6.8.1 - 2022-12-19
6.8.0 - 2022-12-05
6.7.5 - 2022-11-30
6.7.4 - 2022-11-28
6.7.3 - 2022-11-22
6.7.2 - 2022-11-07

from mongoose GitHub release notes

Package name: nodemailer

6.9.14 - 2024-06-19
6.9.14 (2024-06-19)

Bug Fixes
- api: Added support for Ethereal authentication (56b2205)
- services.json: Add Email Services Provider Feishu Mail (CN) (#1648) (e9e9ecc)
- services.json: update Mailtrap host and port in well known (#1652) (fc2c9ea)
- well-known-services: Add Loopia in well known services (#1655) (21a28a1)
6.9.13 - 2024-03-20
6.9.13 (2024-03-20)

Bug Fixes
- tls: Ensure servername for SMTP (d66fdd3)
6.9.12 - 2024-03-08
6.9.12 (2024-03-08)

Bug Fixes
- message-generation: Escape single quote in address names (4ae5fad)
6.9.11 - 2024-02-29
6.9.11 (2024-02-29)

Bug Fixes
- headers: Ensure that Content-type is the bottom header (c7cf97e)
6.9.10 - 2024-02-22
6.9.10 (2024-02-22)

Bug Fixes
- data-uri: Do not use regular expressions for parsing data URI schemes (12e65e9)
- data-uri: Moved all data-uri regexes to use the non-regex parseDataUri method (edd5dfe)
6.9.9 - 2024-02-01
6.9.9 (2024-02-01)

Bug Fixes
- security: Fix issues described in GHSA-9h6g-pr28-7cqp. Do not use eternal matching pattern if only a few occurences are expected (dd8f5e8)
- tests: Use native node test runner, added code coverage support, removed grunt (#1604) (be45c1b)
6.9.8 - 2023-12-30
6.9.8 (2023-12-30)

Bug Fixes
- punycode: do not use native punycode module (b4d0e0c)
6.9.7 - 2023-10-22
6.9.7 (2023-10-22)

Bug Fixes
- customAuth: Do not require user and pass to be set for custom authentication schemes (fixes #1584) (41d482c)
6.9.6 - 2023-10-09
6.9.6 (2023-10-09)

Bug Fixes
- inline: Use 'inline' as the default Content Dispostion value for embedded images (db32c93)
- tests: Removed Node v12 from test matrix as it is not compatible with the test framework anymore (7fe0a60)
6.9.5 - 2023-09-06
6.9.5 (2023-09-06)

Bug Fixes
- license: Updated license year (da4744e)
6.9.4 - 2023-07-19
6.9.3 - 2023-05-29
6.9.2 - 2023-05-11
6.9.1 - 2023-01-27
6.9.0 - 2023-01-12
6.8.0 - 2022-09-28

from nodemailer GitHub release notes

Package name: pdfkit

0.15.0 - 2024-03-24
- Add subset for PDF/UA
- Fix for line breaks in list items (#1486)
- Fix for soft hyphen not being replaced by visible hyphen if necessary (#457)
- Optimize output files by ignoring identity transforms
- Fix for Acroforms - setting an option to false will still apply the flag (#1495)
- Fix for text extraction in PDFium-based viewers due to invalid ToUnicodeMap (#1498)
- Remove deprecated write method
- Drop support for Node.js < 18 and for browsers released before 2020
0.14.0 - 2023-11-09
- Add support for PDF/A-1b, PDF/A-1a, PDF/A-2b, PDF/A-2a, PDF/A-3b, PDF/A-3a
- Update crypto-js to v4.2.0 (properly fix security issue)
0.13.0 - 2021-10-24
- Add tiling pattern support

from pdfkit GitHub release notes

Package name: ws

8.18.0 - 2024-07-03
Features
- Added support for Blob (#2229).

8.17.1 - 2024-06-16

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding theserver.maxHeadersCount
threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;

for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;

<span class="pl-k">for</span> <span class="pl-kos">(</span><span class="pl-k">let</span> <span class="pl-s1">j</span> <span class="pl-c1">=</span> <span class="pl-c1">0</span><span class="pl-kos">;</span> <span class="pl-s1">j</span> <span class="pl-c1">&lt;</span> <span class="pl-s1">chars</span><span class="pl-kos">.</span><span class="pl-c1">length</span><span class="pl-kos">;</span> <span class="pl-s1">j</span><span class="pl-c1">++</span><span class="pl-kos">)</span> <span class="pl-kos">{</span>
  <span class="pl-k">const</span> <span class="pl-s1">key</span> <span class="pl-c1">=</span> <span class="pl-s1">chars</span><span class="pl-kos">[</span><span class="pl-s1">i</span><span class="pl-kos">]</span> <span class="pl-c1">+</span> <span class="pl-s1">chars</span><span class="pl-kos">[</span><span class="pl-s1">j</span><span class="pl-kos">]</span><span class="pl-kos">;</span>
  <span class="pl-s1">headers</span><span class="pl-kos">[</span><span class="pl-s1">key</span><span class="pl-kos">]</span> <span class="pl-c1">=</span> <span class="pl-s">'x'</span><span class="pl-kos">;</span>

  <span class="pl-k">if</span> <span class="pl-kos">(</span><span class="pl-c1">++</span><span class="pl-s1">count</span> <span class="pl-c1">===</span> <span class="pl-c1">2000</span><span class="pl-kos">)</span> <span class="pl-k">break</span><span class="pl-kos">;</span>
<span class="pl-kos">}</span>

}

headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';

const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});

request.end();
});

The vulnerability was reported by Ryan LaPointe in #2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

Reduce the maximum allowed length of the request headers using the
--max-http-header-size=size and/or the

Snyk has created this PR to upgrade: - @vonage/server-sdk from 3.0.0 to 3.16.0. See this package in npm: https://www.npmjs.com/package/@vonage/server-sdk - dotenv from 16.0.3 to 16.4.5. See this package in npm: https://www.npmjs.com/package/dotenv - express from 4.18.2 to 4.19.2. See this package in npm: https://www.npmjs.com/package/express - express-rate-limit from 6.6.0 to 6.11.2. See this package in npm: https://www.npmjs.com/package/express-rate-limit - express-session from 1.17.3 to 1.18.0. See this package in npm: https://www.npmjs.com/package/express-session - helmet from 6.0.0 to 6.2.0. See this package in npm: https://www.npmjs.com/package/helmet - moment from 2.29.4 to 2.30.1. See this package in npm: https://www.npmjs.com/package/moment - mongoose from 6.7.2 to 6.13.0. See this package in npm: https://www.npmjs.com/package/mongoose - nodemailer from 6.8.0 to 6.9.14. See this package in npm: https://www.npmjs.com/package/nodemailer - pdfkit from 0.13.0 to 0.15.0. See this package in npm: https://www.npmjs.com/package/pdfkit - ws from 8.11.0 to 8.18.0. See this package in npm: https://www.npmjs.com/package/ws See this project in Snyk: https://app.snyk.io/org/faroukamr/project/dc39063e-0f74-4a21-860b-c5ff7f29e1ed?utm_source=github&utm_medium=referral&page=upgrade-pr

FaroukAmr self-assigned this Sep 21, 2024

[Snyk] Upgrade: , dotenv, express, express-rate-limit, express-session, helmet, moment, mongoose, nodemailer, pdfkit, ws #1151

Are you sure you want to change the base?

[Snyk] Upgrade: , dotenv, express, express-rate-limit, express-session, helmet, moment, mongoose, nodemailer, pdfkit, ws #1151

Conversation

FaroukAmr commented Sep 21, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

What's Changed

New Contributors

Main Changes

Other Changes

New Contributors

Fixed

Fixed

Added

Added

Added

Changed

Changed

Added

Fixed

Changed

Changed

6.9.14 (2024-06-19)

Bug Fixes

6.9.13 (2024-03-20)

Bug Fixes

6.9.12 (2024-03-08)

Bug Fixes

6.9.11 (2024-02-29)

Bug Fixes

6.9.10 (2024-02-22)

Bug Fixes

6.9.9 (2024-02-01)

Bug Fixes

6.9.8 (2023-12-30)

Bug Fixes

6.9.7 (2023-10-22)

Bug Fixes

6.9.6 (2023-10-09)

Bug Fixes

6.9.5 (2023-09-06)

Bug Fixes

Features

Bug fixes