Skip to content

[Security] semver (dependency) vulnerable to Regular Expression Denial of Service #733

@KareemMAX

Description

@KareemMAX

Describe the bug
This package is dependent on an old version of postman-collection which is dependent on a vulnerable semver version.

To Reproduce
When running npm audit the following output appears:

semver  7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
Will install postman-code-generators@1.0.2, which is a breaking change
node_modules/postman-collection/node_modules/semver
  postman-collection  3.6.0-beta.1 - 4.1.7
  Depends on vulnerable versions of semver
  node_modules/postman-collection
    postman-code-generators  >=1.1.0
    Depends on vulnerable versions of postman-collection
    node_modules/postman-code-generators

3 moderate severity vulnerabilities

Fix suggestion
Update postman-collection to version 4.4.0.

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions