High synk vulnerability. Regular Expression Denial of Service

[vardeyk-yellow]

Questions?

There's a high SYNK vulnerabilty which was introduced through kafka-node@5.0.0 > snappy@6.3.5 > prebuild-install@5.3.0 > npmlog@4.1.2 > gauge@2.7.4 > strip-ansi@3.0.1 > ansi-regex@2.1.1

Bug Report

Environment

• Node version: v14.20.0
• Kafka-node version:kafka-node@5.0.0

[Globant-Eduardo-Cerda]

Should be solved adding "overrides": { "snappy": "^7.0.1" } to your package.json