Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

ced

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    Improper Handling of Unexpected Data Type in ced

    CVE-2021-39131 · GHSA-27wq-qx3q-fxm9

    Affected
    • npm ced < 1.0.0
    Fixed in
    1.0.0· Vendor fix available
    Issue
    Impact In ced v0.1.0, passing data types other than Buffer causes the Node.js process to crash. Patches The problem has been patched in ced v1.0.0. You can upgrade from v0.1.0 without any breaking changes. Workarounds Before passing an argument to ced, verify it’s a Buffer using Buffer.isBuffer(obj). CVSS score CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C Base Score: 7.5 (High) Temporal Score: 7.2 (High) Since ced is a library, the scoring is based on the “reasonable worst-case implementation scenario”, namely, accepting data from untrusted sources over a network and passing it directly to ced. Depending on your specific implementation, the vulnerability’s severity in your program may be different. Proof of concept curl --request POST --header "Content-Type: text/plain" --data foo http://localhost:3000 crashes the server. References - https://github.com/sonicdoe/ced/commit/a4d9f10b6bf1cd468d1a5b9a283cdf437f8bb7b3

    Recommended action: Upgrade to 1.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →