GitHub Advisoryadvisory · npm

GHSA-4g53-vp7q-gfjv constructEvent does not verify header

HIGH Published 2021-05-28 Modified 2021-05-27 Official page ↗

Ecosystem: npm
Packages: @worker-tools/stripe-webhook
Severity: High
Reviewed: 2021-05-27

Affected packages

• npm @worker-tools/stripe-webhook: < 1.1.4 → fixed in 1.1.4

Description

Impact Anyone verifying a Stripe webhook request via this library's `constructEvent` function. Patches Upgrade to 1.1.4. Workarounds Use `await verifyHeader(...)` directly instead of `constructEvent`. References https://github.com/worker-tools/stripe-webhook/issues/1

References

https://github.com/worker-tools/stripe-webhook/security/advisories/GHSA-4g53-vp7q-gfjv web