Skip to content
OpenAdvisories

Vendor

node-saml

9 known vulnerabilities.

Products

node-saml 4 xml-crypto 3 passport-saml 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2023-40178

    @node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError

    Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user whe…

    node-saml node-saml @node-saml/node-saml npm
  • Medium 5.3
    CVE-2021-39171

    Unlimited transforms allowed for signed nodes

    Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or…

    node-saml passport-saml passport-saml npm