Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
Summary of Vulnerable Dependencies (click to show all)
| Dependency | Vulnerability IDs | Package | Highest Severity | CVE Count | Confidence | Evidence Count |
|---|---|---|---|---|---|---|
| ajv | pkg:npm/ajv | MODERATE | 1 | 2 | ||
| eslint.config.js | 0 | 0 | ||||
| hono | pkg:npm/hono | LOW | 1 | 2 | ||
| minimatch | pkg:npm/minimatch | HIGH | 1 | 2 | ||
| package.json | 0 | 0 |
File Path: /builds/ztest/p26005_ztest/pnpm-lock.yaml?ajv
Referenced In Project/Scope: pnpm-lock.yaml: transitive
ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the `$data` option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax (`$data` reference), which is passed directly to the JavaScript `RegExp()` constructor without validation. An attacker can inject a malicious regex pattern (e.g., `\"^(a|a)*$\"`) combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with `$data`: true for dynamic schema validation.CWE-400 Uncontrolled Resource Consumption, CWE-1333 Inefficient Regular Expression Complexity
Vulnerable Software & Versions (NPM):
File Path: /builds/ztest/p26005_ztest/eslint.config.js
MD5: bbc0c3f46068d442caf1183a1b639ea7
SHA1: 2f805edcb3a34f2558ba532b620925617352ee2c
SHA256:04d0928205866bab46b6e89f607688ea9ee6877d255c1529951319d35c8c0ed7
File Path: /builds/ztest/p26005_ztest/pnpm-lock.yaml?hono
Referenced In Project/Scope: pnpm-lock.yaml: transitive
## Summary The `basicAuth` and `bearerAuth` middlewares previously used a comparison that was not fully timing-safe. The `timingSafeEqual` function used normal string equality (`===`) when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing differences. The implementation has been updated to use a safer comparison method. ## Details The issue was caused by the use of normal string equality (`===`) when comparing hash values inside the `timingSafeEqual` function. In JavaScript, string comparison may stop as soon as a difference is found. This means the comparison time can slightly vary depending on how many characters match. Under very specific and controlled conditions, this behavior could theoretically allow timing-based analysis. The implementation has been updated to: - Avoid early termination during comparison - Use a constant-time-style comparison method ## Impact This issue is unlikely to be exploited in normal environments. It may only be relevant in highly controlled situations where precise timing measurements are possible. This change is considered a security hardening improvement. Users are encouraged to upgrade to the latest version.CWE-208 Observable Timing Discrepancy
Vulnerable Software & Versions (NPM):
File Path: /builds/ztest/p26005_ztest/pnpm-lock.yaml?minimatch
Referenced In Project/Scope: pnpm-lock.yaml: transitive
### Summary `minimatch` is vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive `*` wildcards followed by a literal character that doesn't appear in the test string. Each `*` compiles to a separate `[^/]*?` regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of `*` characters. With N=15, a single `minimatch()` call takes ~2 seconds. With N=34, it hangs effectively forever. ### Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ ### PoC When minimatch compiles a glob pattern, each `*` becomes `[^/]*?` in the generated regex. For a pattern like `***************X***`: ``` /^(?!\.)[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?[^/]*?X[^/]*?[^/]*?[^/]*?$/ ``` When the test string doesn't contain `X`, the regex engine must try every possible way to distribute the characters across all the `[^/]*?` groups before concluding no match exists. With N groups and M characters, this is O(C(N+M, N)) — exponential. ### Impact Any application that passes user-controlled strings to `minimatch()` as the pattern argument is vulnerable to DoS. This includes: - File search/filter UIs that accept glob patterns - `.gitignore`-style filtering with user-defined rules - Build tools that accept glob configuration - Any API that exposes glob matching to untrusted input ---- Thanks to @ljharb for back-porting the fix to legacy versions of minimatch.CWE-1333 Inefficient Regular Expression Complexity
Vulnerable Software & Versions (NPM):
File Path: /builds/ztest/p26005_ztest/package.json
MD5: c053ea705d32f70063db085f778084ad
SHA1: bee52c00e7d382000394c634cde8454fd8013109
SHA256:b157298d1cf03b9cd97ebeed406d7d1332e46f0f7c73765428efda714e1f03dc