koa-router-7.4.0.tgz: 9 vulnerabilities (highest severity is: 8.0) #15
Description
Vulnerable Library - koa-router-7.4.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Found in HEAD commit: e3d23cf443c08ca8f62eb3d2b7c0fa9098138639
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (koa-router version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2022-0868 |  High |
8.0 | urijs-1.19.1.tgz | Transitive | 8.0.6 | ✅ |
| CVE-2024-45296 | High |
7.5 | path-to-regexp-1.7.0.tgz | Transitive | 8.0.6 | ✅ |
| CVE-2021-27516 | High |
7.5 | urijs-1.19.1.tgz | Transitive | 8.0.6 | ✅ |
| CVE-2022-1243 | High |
7.2 | urijs-1.19.1.tgz | Transitive | N/A* | ❌ |
| CVE-2022-1233 |  Medium |
6.5 | urijs-1.19.1.tgz | Transitive | 8.0.6 | ✅ |
| CVE-2020-26291 | Medium |
6.5 | urijs-1.19.1.tgz | Transitive | 8.0.6 | ✅ |
| CVE-2022-24723 | Medium |
5.3 | urijs-1.19.1.tgz | Transitive | N/A* | ❌ |
| CVE-2022-0613 | Medium |
5.3 | urijs-1.19.1.tgz | Transitive | N/A* | ❌ |
| CVE-2021-3647 | Medium |
5.3 | urijs-1.19.1.tgz | Transitive | 8.0.6 | ✅ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-0868
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: e3d23cf443c08ca8f62eb3d2b7c0fa9098138639
Found in base branch: main
Vulnerability Details
Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.
Publish Date: 2022-03-06
URL: CVE-2022-0868
CVSS 3 Score Details (8.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: High
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0868
Release Date: 2022-03-06
Fix Resolution (urijs): 1.19.10
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2024-45296
Vulnerable Library - path-to-regexp-1.7.0.tgz
Express style path to RegExp utility
Library home page: https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.7.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/path-to-regexp/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ path-to-regexp-1.7.0.tgz (Vulnerable Library)
Found in HEAD commit: e3d23cf443c08ca8f62eb3d2b7c0fa9098138639
Found in base branch: main
Vulnerability Details
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
Publish Date: 2024-09-09
URL: CVE-2024-45296
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-9wv6-86v2-598j
Release Date: 2024-09-09
Fix Resolution (path-to-regexp): 1.9.0
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2021-27516
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: e3d23cf443c08ca8f62eb3d2b7c0fa9098138639
Found in base branch: main
Vulnerability Details
URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2021-02-21
URL: CVE-2021-27516
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27516
Release Date: 2021-02-21
Fix Resolution (urijs): 1.19.6
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2022-1243
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: e3d23cf443c08ca8f62eb3d2b7c0fa9098138639
Found in base branch: main
Vulnerability Details
CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.
Publish Date: 2022-04-05
URL: CVE-2022-1243
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-3vjf-82ff-p4r3
Release Date: 2022-04-05
Fix Resolution: urijs - 1.19.11
CVE-2022-1233
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: e3d23cf443c08ca8f62eb3d2b7c0fa9098138639
Found in base branch: main
Vulnerability Details
URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
Publish Date: 2022-04-04
URL: CVE-2022-1233
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1233
Release Date: 2022-04-04
Fix Resolution (urijs): 1.19.11
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-26291
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: e3d23cf443c08ca8f62eb3d2b7c0fa9098138639
Found in base branch: main
Vulnerability Details
URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash ("") character followed by an at ("@") character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL "https://expected-example.com\@observed-example.com" will incorrectly return "observed-example.com" if using an affected version. Patched versions correctly return "expected-example.com". Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2020-12-30
URL: CVE-2020-26291
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26291
Release Date: 2020-12-30
Fix Resolution (urijs): 1.19.4
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2022-24723
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: e3d23cf443c08ca8f62eb3d2b7c0fa9098138639
Found in base branch: main
Vulnerability Details
URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.
Publish Date: 2022-03-03
URL: CVE-2022-24723
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-gmv4-r438-p67f
Release Date: 2022-03-03
Fix Resolution: urijs - 1.19.9
CVE-2022-0613
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: e3d23cf443c08ca8f62eb3d2b7c0fa9098138639
Found in base branch: main
Vulnerability Details
Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.
Publish Date: 2022-02-16
URL: CVE-2022-0613
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083/
Release Date: 2022-02-16
Fix Resolution: uri.js - v1.19.8
CVE-2021-3647
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: e3d23cf443c08ca8f62eb3d2b7c0fa9098138639
Found in base branch: main
Vulnerability Details
URI.js is vulnerable to URL Redirection to Untrusted Site
Publish Date: 2021-07-16
URL: CVE-2021-3647
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-89gv-h8wf-cg8r
Release Date: 2021-07-16
Fix Resolution (urijs): 1.19.7
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.