[Snyk] Security upgrade express from 4.17.1 to 4.20.0 #84
Security Report
❌ New vulnerabilities:
| CVE | Severity |  CVSS Score |
Vulnerable Library | Suggested Fix | Issue |
|---|---|---|---|---|---|
CVE-2024-37890Path to dependency file: /package.json Path to vulnerable library: /node_modules/engine.io/node_modules/ws/package.json Dependency Hierarchy: -> socket.io-4.5.2.tgz (Root Library) -> engine.io-6.2.1.tgz -> ❌ ws-8.2.3.tgz (Vulnerable Library) |
 High |
7.5 | ws-8.2.3.tgz | Upgrade to version: ws - 5.2.4,6.2.3,7.5.10,8.17.1 | None |
CVE-2024-38355Path to dependency file: /package.json Path to vulnerable library: /node_modules/socket.io/package.json Dependency Hierarchy: -> ❌ socket.io-4.5.2.tgz (Vulnerable Library) |
High |
7.3 | socket.io-4.5.2.tgz | Upgrade to version: socket.io - 2.5.1,4.6.2 | None |
CVE-2023-31125Path to dependency file: /package.json Path to vulnerable library: /node_modules/engine.io/package.json Dependency Hierarchy: -> socket.io-4.5.2.tgz (Root Library) -> ❌ engine.io-6.2.1.tgz (Vulnerable Library) |
 Medium |
6.5 | engine.io-6.2.1.tgz | Upgrade to version: engine.io - 6.4.2 | None |
CVE-2024-43799Path to dependency file: /package.json Path to vulnerable library: /node_modules/send/package.json Dependency Hierarchy: -> serve-static-1.16.0.tgz (Root Library) -> ❌ send-0.18.0.tgz (Vulnerable Library) |
Medium |
5.0 | send-0.18.0.tgz | Upgrade to version: send - 0.19.0 | None |
✔️ Remediated vulnerabilities:
| CVE | Vulnerable Library |
|---|---|
| CVE-2017-20165 | debug-2.2.0.tgz |
| CVE-2024-38355 | socket.io-3.0.0.tgz |
| CVE-2024-38355 | socket.io-2.5.0.tgz |
| CVE-2017-20162 | ms-0.7.1.tgz |
| CVE-2022-2564 | mongoose-5.11.7.tgz |
| CVE-2023-32695 | socket.io-parser-4.0.5.tgz |
| CVE-2023-3696 | mongoose-5.11.7.tgz |
| CVE-2023-28155 | request-2.85.0.tgz |
| CVE-2024-45590 | body-parser-1.19.0.tgz |
| CVE-2020-11022 | jquery-1.8.3.tgz |
| CVE-2020-11023 | jquery-1.8.3.tgz |
| CVE-2022-29167 | hawk-6.0.2.tgz |
| CVE-2024-43800 | serve-static-1.14.1.tgz |
| CVE-2024-43796 | express-4.17.1.tgz |
| CVE-2022-24999 | qs-6.7.0.tgz |
| CVE-2021-23438 | mpath-0.8.1.tgz |
| CVE-2024-37890 | ws-7.4.6.tgz |
| CVE-2012-6708 | jquery-1.8.3.tgz |
| CVE-2024-43799 | send-0.17.1.tgz |
| CVE-2017-16137 | debug-2.2.0.tgz |
| CVE-2024-45590 | body-parser-1.19.2.tgz |
| CVE-2023-26136 | tough-cookie-2.3.4.tgz |
| CVE-2020-28502 | xmlhttprequest-1.4.2.tgz |
| CVE-2019-11358 | jquery-1.8.3.tgz |
| CVE-2024-45296 | path-to-regexp-0.1.7.tgz |
| CVE-2022-41940 | engine.io-4.0.6.tgz |
| CVE-2021-29469 | redis-2.7.1.tgz |
| CVE-2020-15366 | ajv-5.5.2.tgz |
| CVE-2024-29041 | express-4.17.1.tgz |
| CVE-2020-7656 | jquery-1.8.3.tgz |
| CVE-2022-21676 | engine.io-4.0.6.tgz |
| CVE-2021-32050 | mongodb-3.6.3.tgz |
| CVE-2015-9251 | jquery-1.8.3.tgz |
Base branch total remaining vulnerabilities: 101
Base branch commit: 28b51e6b953d829e94462c5d11c4d55497e5ecf2
Total libraries scanned: 571
Scan token: 22565cb9145d41f9812a4de443473fd7