GitHub Advisoryadvisory · npm

GHSA-gg6m-fhqv-hg56 Denial of Service in yar

HIGH Published 2020-09-01 Modified 2021-09-23 Official page ↗
Aliases
CVE-2014-4179
Ecosystem
npm
Packages
yar
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-08-31

Affected packages

• npm yar: < 2.2.0 → fixed in 2.2.0

Description

Versions of `yar` prior to 2.2.0 are affected by a denial of service vulnerability related to an invalid encrypted session cookie value. When an invalid encryped session cookie value is provided, the process will crash. Recommendation Update to version 2.2.0 or later.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References