express-session-1.18.2.tgz: 1 vulnerabilities (highest severity is: 9.8) [master]

[mend-developer-platform-dev]

📂 Vulnerable Library - express-session-1.18.2.tgz

Simple session middleware for Express

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express-session/package.json

Findings

Finding	Severity	🎯 CVSS	Exploit Maturity	EPSS	Library	Type	Fixed in	Remediation Available	Reachability
CVE-616547-419802	🟣 Critical	9.8	N/A	N/A	parseurl-1.3.3.tgz	Transitive	N/A	❌

Details

🟣CVE-616547-419802

Vulnerable Library - parseurl-1.3.3.tgz

parse a url with memoization

Library home page: https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parseurl/package.json

Dependency Hierarchy:

• express-session-1.18.2.tgz (Root Library)

  • ❌ parseurl-1.3.3.tgz (Vulnerable Library)

• express-4.21.2.tgz (Root Library)

  • serve-static-1.16.2.tgz
    • ❌ parseurl-1.3.3.tgz (Vulnerable Library)

---

Vulnerability Details

Created automatically by the test suite

Publish Date: Jun 07, 2010 05:12 PM

URL: CVE-616547-419802

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :