Skip to content

fix(deps): update dependency body-parser to v1.20.3 [security]#1493

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-body-parser-vulnerability
Open

fix(deps): update dependency body-parser to v1.20.3 [security]#1493
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-body-parser-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Sep 13, 2024

This PR contains the following updates:

Package Change Age Confidence
body-parser 1.20.21.20.3 age confidence

GitHub Vulnerability Alerts

CVE-2024-45590

Impact

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

Patches

this issue is patched in 1.20.3

References


Release Notes

expressjs/body-parser (body-parser)

v1.20.3

Compare Source

===================

  • deps: qs@​6.13.0
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Contributor Author

renovate bot commented Sep 13, 2024

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: http-proxy-middleware/yarn.lock
error SyntaxError: Invalid value type 3464:0 in /tmp/renovate/repos/github/dlminvestments/node-js-server/http-proxy-middleware/yarn.lock
    at Parser.unexpected (/opt/containerbase/tools/yarn-slim/1.22.22/24.14.0/node_modules/yarn/lib/cli.js:64026:11)
    at Parser.parse (/opt/containerbase/tools/yarn-slim/1.22.22/24.14.0/node_modules/yarn/lib/cli.js:64154:16)
    at parse (/opt/containerbase/tools/yarn-slim/1.22.22/24.14.0/node_modules/yarn/lib/cli.js:64231:21)
    at module.exports.exports.default (/opt/containerbase/tools/yarn-slim/1.22.22/24.14.0/node_modules/yarn/lib/cli.js:63793:96)
    at Lockfile.<anonymous> (/opt/containerbase/tools/yarn-slim/1.22.22/24.14.0/node_modules/yarn/lib/cli.js:3068:63)
    at Generator.next (<anonymous>)
    at step (/opt/containerbase/tools/yarn-slim/1.22.22/24.14.0/node_modules/yarn/lib/cli.js:310:30)
    at /opt/containerbase/tools/yarn-slim/1.22.22/24.14.0/node_modules/yarn/lib/cli.js:321:13

@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Sep 13, 2024

Deploying node-js-server with  Cloudflare Pages  Cloudflare Pages

Latest commit: 96c3def
Status: ✅  Deploy successful!
Preview URL: https://a6687295.node-js-server.pages.dev
Branch Preview URL: https://renovate-npm-body-parser-vul.node-js-server.pages.dev

View logs

@renovate renovate bot force-pushed the renovate/npm-body-parser-vulnerability branch from bb4d89a to 96c3def Compare September 20, 2024 23:33
@renovate renovate bot changed the title chore(deps): update dependency body-parser to v1.20.3 [security] fix(deps): update dependency body-parser to v1.20.3 [security] Dec 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants