GitHub Advisoryadvisory · npm

GHSA-hrpp-f84w-xhfg Outdated Static Dependency in vue-moment

MEDIUM Published 2020-09-04 Modified 2021-10-04 Official page ↗
Ecosystem
npm
Packages
vue-moment
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1104
Reviewed
2020-08-31

Affected packages

• npm vue-moment: < 4.1.0 → fixed in 4.1.0

Description

Versions of `vue-moment` prior to 4.1.0 contain an Outdated Static Dependency. The package depends on `moment` and has it loaded statically instead of as a dependency that can be updated. It has `[email protected]` that contains a Regular Expression Denial of Service vulnerability. Recommendation Upgrade to version 4.1.0 or later.

Related

Weakness · CWE (1)

  • CWE-1104 Use of Unmaintained Third Party Components weakness

References