Regular Expression Denial of Service (ReDoS)

[phongle2512]

Snyk reports Regular Expression Denial of Service (ReDoS) on memoizee@0.4.17

[medikoo]

@phongle2512 screenhost didn't upload. Can you provide more details, maybe a link to Snyk page?

[phongle2512]

@phongle2512 screenhost didn't upload. Can you provide more details, maybe a link to Snyk page?

@medikoo Re-attach the screenshot
Detailed paths
Introduced through: memoizee@0.4.17 › d@1.0.2 › es5-ext@0.10.64 › es6-iterator@2.0.3 › d@1.0.1 › es5-ext@0.10.61
Security information
Factors contributing to the scoring:
Snyk: CVSS 7.5 - High Severity
NVD: Not available. NVD has not yet published its analysis.

[medikoo]

@phongle2512 this report is incorrect.

The corresponding vulnerability was fixed with es5-ext@0.10.63, while memoizee@0.4.17 at minimum requires es5-ext@0.10.64

[phongle2512]

@medikoo You can see the detailed paths that Synk was reported
Detailed paths
Introduced through: memoizee@0.4.17 › d@1.0.2 › es5-ext@0.10.64 › es6-iterator@2.0.3 › d@1.0.1 › es5-ext@0.10.61

[medikoo]

Yes, but this not how this will be ever installed, as memoizee requires at least es5-ext@0.10.64, all its other dependencies will also depend on this version

There's no package manager that will install it differently, feel free to test

[phongle2512]

From the detailed paths, Synk is reporting to your es6-iterator@2.0.3 › d@1.0.1 › es5-ext@0.10.61, it should use the d@1.0.2 instead.

[medikoo]

From the detailed paths, Synk is reporting to your es6-iterator@2.0.3 › d@1.0.1 › es5-ext@0.10.61, it should use the d@1.0.2 instead.

es-iterator's dependency on d is ^1.0.1, which means at minimum v1.0.1. If anything requires any greater version in v1 range, it'll be used instead (not to mention, that installers always install the latest that match the range). Here memoizee requires ^1.0.2, so it's what es6-iterator ends with.

Feel free to play with any node packages installer when installing memoizee, and you'll never see es5-ext below v0.10.64` installed beneath