Regular Expression Denial of Service (ReDoS)

[petey]

hapi-auth-jwt requires an old version of jsonwebtoken (5.x), which depends on ms which has a ReDoS vulnerability. Please update jsonwebtoken to use at least 7.4.1 which has fixed this issue.

Thanks!

https://snyk.io/test/github/screwdriver-cd/screwdriver.git

[antony]

This plugin seems to be largely abandoned, see https://www.npmjs.com/package/hapi-auth-jwt2 for a maintained version.

[petey]

Thanks.