Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

express-session vulnerability since it is still using a very old cookie-signature version #989

Open
andiclone opened this issue Jun 20, 2024 · 1 comment

Comments

@andiclone
Copy link

Vulnerability

express-session, even in the latest v1.18.0, is still using cookie-signature v1.0.7 which is over a year old and it has a 'sha1' vulnerability: https://owasp.org/Top10/A02_2021-Cryptographic_Failures/

Problem

In my project I have this reported since over 5 months ago with the latest change in this package, but still no newer version has come out to fix this vulnerability

Solution

Upgrade the dependency on cookie-signature to a newer version, ideally 1.2.1 where it changes the old sha1 standard to a much more secure and updated sha256

Notes

This is my first time posting an issue here so if I'm missing something please let me know :)

@lucianidev
Copy link

i created a fix, I will create a pr

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants