nodejs-nodemon

44 results · Feed

• High —
  CVE-2016-10539

  Regular Expression Denial of Service in negotiator

  negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via …

  HackerOne negotiator node module nodejs-nodemon node-negotiator Debian Ubuntu Azure Linux npm
  May 31, 2018
• High 7.5
  CVE-2017-1000048

  Prototype Pollution Protection Bypass in qs

  the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

  nodejs-nodemon qs Azure Linux npm
  Jul 13, 2017
• Medium 5.3
  CVE-2015-8859

  Root Path Disclosure in send

  The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

  nodejs-nodemon send node-send node-send Debian Ubuntu Azure Linux npm
  Jan 23, 2017
• Low 3.1
  CVE-2015-1164

  Open Redirect in serve-static

  Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_IN…

  nodejs-nodemon serve-static node-serve-static Debian Azure Linux npm
  Jan 21, 2015