deepkit-framework
deepkit-framework copied to clipboard
Upgrade vulnerable package selfsigned
After installing @deepkit/framework:
$ npm audit
# npm audit report
node-forge <=1.2.1
Severity: high
Open Redirect in node-forge - https://github.com/advisories/GHSA-8fr3-hfg3-gpgp
Prototype Pollution in node-forge debug API. - https://github.com/advisories/GHSA-5rrq-pxf6-6jx5
Improper Verification of Cryptographic Signature in `node-forge` - https://github.com/advisories/GHSA-2r2c-g63r-vccr
Improper Verification of Cryptographic Signature in node-forge - https://github.com/advisories/GHSA-x4jg-mjrx-434g
Improper Verification of Cryptographic Signature in node-forge - https://github.com/advisories/GHSA-cfm4-qjh2-4765
URL parsing in node-forge could lead to undesired behavior. - https://github.com/advisories/GHSA-gf8q-jrpm-jvxq
The report also mentions that @deepkit/framework depends on vulnerable versions of selfsigned (1.1.1 - 1.10.14) which in turn depend on vulnerable versions of node-forge (<=1.2.1).
It seems that a simple way to resolve this issue would be to upgrade the selfsigned library to its latest version 2.1.1.