Vulnerable Library - koa-router-7.4.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Found in HEAD commit: 9737f1402f7e500def108c5fc83ec43ee50b6430
Vulnerabilities
CVE |
Severity |
CVSS |
Dependency |
Type |
Fixed in (koa-router version) |
Remediation Available |
CVE-2021-27516 |
High |
7.5 |
urijs-1.19.1.tgz |
Transitive |
8.0.6 |
✅ |
CVE-2022-0613 |
Medium |
6.5 |
urijs-1.19.1.tgz |
Transitive |
N/A* |
❌ |
CVE-2020-26291 |
Medium |
6.5 |
urijs-1.19.1.tgz |
Transitive |
8.0.6 |
✅ |
CVE-2022-1243 |
Medium |
6.1 |
urijs-1.19.1.tgz |
Transitive |
8.0.6 |
✅ |
CVE-2022-1233 |
Medium |
6.1 |
urijs-1.19.1.tgz |
Transitive |
8.0.6 |
✅ |
CVE-2022-0868 |
Medium |
6.1 |
urijs-1.19.1.tgz |
Transitive |
8.0.6 |
✅ |
CVE-2021-3647 |
Medium |
6.1 |
urijs-1.19.1.tgz |
Transitive |
8.0.6 |
✅ |
CVE-2022-24723 |
Medium |
5.3 |
urijs-1.19.1.tgz |
Transitive |
8.0.6 |
✅ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2021-27516
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: 9737f1402f7e500def108c5fc83ec43ee50b6430
Found in base branch: main
Vulnerability Details
URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path.
Publish Date: 2021-02-22
URL: CVE-2021-27516
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27516
Release Date: 2021-02-22
Fix Resolution (urijs): 1.19.6
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation is available for this issue
CVE-2022-0613
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: 9737f1402f7e500def108c5fc83ec43ee50b6430
Found in base branch: main
Vulnerability Details
Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.
Publish Date: 2022-02-16
URL: CVE-2022-0613
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083/
Release Date: 2022-02-16
Fix Resolution: uri.js - v1.19.8
CVE-2020-26291
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: 9737f1402f7e500def108c5fc83ec43ee50b6430
Found in base branch: main
Vulnerability Details
URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (\
) character followed by an at (@
) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL https://expected-example.com\@observed-example.com
will incorrectly return observed-example.com
if using an affected version. Patched versions correctly return expected-example.com
. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]
Publish Date: 2020-12-31
URL: CVE-2020-26291
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26291
Release Date: 2020-12-31
Fix Resolution (urijs): 1.19.4
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation is available for this issue
CVE-2022-1243
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: 9737f1402f7e500def108c5fc83ec43ee50b6430
Found in base branch: main
Vulnerability Details
CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.
Publish Date: 2022-04-05
URL: CVE-2022-1243
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/8c5afc47-1553-4eba-a98e-024e4cc3dfb7/
Release Date: 2022-04-05
Fix Resolution (urijs): 1.19.11
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation is available for this issue
CVE-2022-1233
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: 9737f1402f7e500def108c5fc83ec43ee50b6430
Found in base branch: main
Vulnerability Details
URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
Publish Date: 2022-04-04
URL: CVE-2022-1233
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1233
Release Date: 2022-04-04
Fix Resolution (urijs): 1.19.11
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation is available for this issue
CVE-2022-0868
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: 9737f1402f7e500def108c5fc83ec43ee50b6430
Found in base branch: main
Vulnerability Details
Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.
Publish Date: 2022-03-06
URL: CVE-2022-0868
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0868
Release Date: 2022-03-06
Fix Resolution (urijs): 1.19.10
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation is available for this issue
CVE-2021-3647
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: 9737f1402f7e500def108c5fc83ec43ee50b6430
Found in base branch: main
Vulnerability Details
URI.js is vulnerable to URL Redirection to Untrusted Site
Publish Date: 2021-07-16
URL: CVE-2021-3647
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-89gv-h8wf-cg8r
Release Date: 2021-07-16
Fix Resolution (urijs): 1.19.7
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation is available for this issue
CVE-2022-24723
Vulnerable Library - urijs-1.19.1.tgz
URI.js is a Javascript library for working with URLs.
Library home page: https://registry.npmjs.org/urijs/-/urijs-1.19.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/urijs/package.json
Dependency Hierarchy:
- koa-router-7.4.0.tgz (Root Library)
- ❌ urijs-1.19.1.tgz (Vulnerable Library)
Found in HEAD commit: 9737f1402f7e500def108c5fc83ec43ee50b6430
Found in base branch: main
Vulnerability Details
URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.
Publish Date: 2022-03-03
URL: CVE-2022-24723
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-gmv4-r438-p67f
Release Date: 2022-03-03
Fix Resolution (urijs): 1.19.9
Direct dependency fix Resolution (koa-router): 8.0.6
⛑️ Automatic Remediation is available for this issue
⛑️ Automatic Remediation is available for this issue.