Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under example.com are protected with the requiresAuth middleware, a visit to http://example.com//google.com will be redirected to google.com after login because the original url reported by the Express framework is not properly sanitised. Am I affected? You are affected by this vulnerability if you are using the requiresAuth middleware on a catch all route or the default authRequired option and express-openid-connect version <=2.7.1. How to fix that? Upgrade to version =2.7.2 Will this update impact my users? The fix provided in the patch will not affect your users.
Recommended action: Upgrade to 2.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions 2.3.0 up to and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Am I affected? You are affected by this vulnerability if you are using express-openid-connect version 2.3.0 up to and including 2.5.1 and use a custom session store. How to fix that? Upgrade to version = 2.5.2. Will this update impact my users? The fix provided in patch will not affect your users.
Recommended action: Upgrade to 2.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.