Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The nestjs-proxy library did not have a way to block sensitive cookies (e.g. session cookies) from being forwarded to backend services configured by the application developer. This could have led to sensitive cookies being inadvertently exposed to such services that should not see them. The patched version now blocks cookies from being forwarded by default. However developers can configure an allow-list of cookie names by using the allowedCookies config setting. Further details of this feature can be found in the library's README on Github or NPM. Patches - This issue has been fixed in version 0.7.0 of @finastra/nestjs-proxy. - Users of @ffdc/nestjs-proxy are advised that this package has been deprecated and is no longer being maintained or receiving updates. Please update your package.json file to use @finastra/nestjs-proxy instead. References - https://github.com/Finastra/finastra-nodejs-libs/pull/232 - https://github.com/Finastra/finastra-nodejs-libs/blob/master/libs/proxy/README.md
Recommended action: Upgrade to 0.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in sensitive information such as OAuth bearer access tokens being inadvertently exposed to such services that should not see them. A new feature has been introduced in the patched version of nestjs-proxy that allows application developers to opt out of forwarding the Authorization headers on a per service basis using the forwardToken config setting. Developers are advised to review the README for this library on Github or NPM for further details on how this configuration can be applied. Patches - This issue has been fixed in version 0.7.0 of @finastra/nestjs-proxy. - Users of @ffdc/nestjs-proxy are advised that this package has been deprecated and is no longer being maintained or receiving updates. Please update your package.json file to use @finastra/nestjs-proxy instead.…
Recommended action: Upgrade to 0.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.