[Snyk] Security upgrade express from 4.18.3 to 4.21.2

[grhawkeye]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• node_UAF/package.json
• node_UAF/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-8482416	721

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[codethreat-sast-cloud]

🚀 CodeThreat Security Scan Completed for vuln_wasm

Hello Team,

Great news! We've just completed a thorough security scan for vuln_wasm, and here's what we found:

---

⏱ Quick Overview

• Duration: 00:02:21
• Risk Score: B (This reflects the overall security posture based on the identified issues.)
• Issues Fixed: 0 (The number of vulnerabilities resolved during this scan.)

---

🛠 Detailed Vulnerability Analysis

We've identified vulnerabilities across the codebase. Here's a detailed look:

Weakness Name	Severity	Count
Insecure Random Number Generator	High	6
Unsafe Dynamic Method Call	Critical	14
Prevent Dynamic Prototype Modification	High	5
Prevent Prototype Pollution	Critical	1
Express Template Injection Safeguards	High	2
Direct User Input To Response	High	3
Buffer Overflow	Critical	25
Use Of Externally Controlled Format String	Medium	9

---

🔗 Software Composition Analysis (SCA) Insights

node_UAF/package-lock.json

Severity Summary: Critical: 0 High: 0 Medium: 0 Low: 0

• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]

node_arbitrary_array_access/package-lock.json

Severity Summary: Critical: 0 High: 8 Medium: 16 Low: 5

• Dependency: [email protected]
  • express: cause malformed URLs to be evaluated
  • express: Improper Input Handling in Express Redirects
  • express: Improper Input Handling in Express Redirects
  • express: cause malformed URLs to be evaluated
  • express: cause malformed URLs to be evaluated
  • express: Improper Input Handling in Express Redirects
• Dependency: [email protected]
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
• Dependency: [email protected]
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
• Dependency: [email protected]
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
• Dependency: [email protected]
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
• Dependency: [email protected]
  • body-parser: Denial of Service Vulnerability in body-parser
  • body-parser: Denial of Service Vulnerability in body-parser
  • body-parser: Denial of Service Vulnerability in body-parser
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]

node_ret2win/package-lock.json

Severity Summary: Critical: 0 High: 8 Medium: 16 Low: 5

• Dependency: [email protected]
  • express: cause malformed URLs to be evaluated
  • express: Improper Input Handling in Express Redirects
  • express: Improper Input Handling in Express Redirects
  • express: cause malformed URLs to be evaluated
  • express: cause malformed URLs to be evaluated
  • express: Improper Input Handling in Express Redirects
• Dependency: [email protected]
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
• Dependency: [email protected]
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
• Dependency: [email protected]
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
• Dependency: [email protected]
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
• Dependency: [email protected]
  • body-parser: Denial of Service Vulnerability in body-parser
  • body-parser: Denial of Service Vulnerability in body-parser
  • body-parser: Denial of Service Vulnerability in body-parser
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]

node_int_overflow/package-lock.json

Severity Summary: Critical: 0 High: 8 Medium: 16 Low: 5

• Dependency: [email protected]
  • express: cause malformed URLs to be evaluated
  • express: Improper Input Handling in Express Redirects
  • express: Improper Input Handling in Express Redirects
  • express: cause malformed URLs to be evaluated
  • express: cause malformed URLs to be evaluated
  • express: Improper Input Handling in Express Redirects
• Dependency: [email protected]
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
• Dependency: [email protected]
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
• Dependency: [email protected]
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
• Dependency: [email protected]
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
• Dependency: [email protected]
  • body-parser: Denial of Service Vulnerability in body-parser
  • body-parser: Denial of Service Vulnerability in body-parser
  • body-parser: Denial of Service Vulnerability in body-parser
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]

node_BOF/package-lock.json

Severity Summary: Critical: 0 High: 7 Medium: 14 Low: 5

• Dependency: [email protected]
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
• Dependency: [email protected]
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
• Dependency: [email protected]
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
• Dependency: [email protected]
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
• Dependency: [email protected]
  • express: cause malformed URLs to be evaluated
  • express: Improper Input Handling in Express Redirects
  • express: cause malformed URLs to be evaluated
  • express: Improper Input Handling in Express Redirects
• Dependency: [email protected]
  • body-parser: Denial of Service Vulnerability in body-parser
  • body-parser: Denial of Service Vulnerability in body-parser
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]

node_format_string/package-lock.json

Severity Summary: Critical: 0 High: 7 Medium: 14 Low: 5

• Dependency: [email protected]
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
  • cookie: cookie accepts cookie name, path, and domain with out of bounds characters
• Dependency: [email protected]
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
  • path-to-regexp: Backtracking regular expressions cause ReDoS
• Dependency: [email protected]
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
  • send: Code Execution Vulnerability in Send Library
• Dependency: [email protected]
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
  • serve-static: Improper Sanitization in serve-static
• Dependency: [email protected]
  • express: cause malformed URLs to be evaluated
  • express: Improper Input Handling in Express Redirects
  • express: cause malformed URLs to be evaluated
  • express: Improper Input Handling in Express Redirects
• Dependency: [email protected]
  • body-parser: Denial of Service Vulnerability in body-parser
  • body-parser: Denial of Service Vulnerability in body-parser
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]
• Dependency: [email protected]

📈 Next Steps & Full Report

To dive deeper, click here to view the full report. It's essential to review these findings and plan the necessary fixes. If any of the critical/high issues need more discussion, let's set up a quick meeting to strategize our next steps.

---

🔒 Security isn't just a feature; it's a responsibility. Let's keep our codebase rock solid!