Outdated FOSS used in express
questiondeps
Hi,
We found below outdated FOSS are used in express, which is a security vulnerability:
<html xmlns:v="urn:schemas-microsoft-com:vml"
xmlns:o="urn:schemas-microsoft-com:office:office"
xmlns:x="urn:schemas-microsoft-com:office:excel"
xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta name=ProgId content=Excel.Sheet>
<meta name=Generator content="Microsoft Excel 15">
<link id=Main-File rel=Main-File
href="file:////Users/I076029/Library/Group%20Containers/UBF8T346G9.Office/TemporaryItems/msohtmlclip/clip.htm">
<link rel=File-List
href="file:////Users/I076029/Library/Group%20Containers/UBF8T346G9.Office/TemporaryItems/msohtmlclip/clip_filelist.xml">
<style>
<!--table
{mso-displayed-decimal-separator:"\.";
mso-displayed-thousand-separator:"\,";}
@page
{margin:.75in .7in .75in .7in;
mso-header-margin:.3in;
mso-footer-margin:.3in;}
tr
{mso-height-source:auto;}
col
{mso-width-source:auto;}
br
{mso-data-placement:same-cell;}
td
{padding-top:1px;
padding-right:1px;
padding-left:1px;
mso-ignore:padding;
color:black;
font-size:12.0pt;
font-weight:400;
font-style:normal;
text-decoration:none;
font-family:"Aptos Narrow", sans-serif;
mso-font-charset:0;
mso-number-format:General;
text-align:general;
vertical-align:bottom;
border:none;
mso-background-source:auto;
mso-pattern:auto;
mso-protection:locked visible;
white-space:nowrap;
mso-rotate:0;}
.xl65
{border:.5pt solid windowtext;}
.xl66
{color:#467886;
text-decoration:underline;
text-underline-style:single;
border:.5pt solid windowtext;}
.xl67
{font-weight:700;
font-family:"Aptos Narrow";
mso-generic-font-family:auto;
mso-font-charset:0;
border:.5pt solid windowtext;}
.xl68
{color:white;
font-weight:700;
font-family:"Aptos Narrow";
mso-generic-font-family:auto;
mso-font-charset:0;
text-align:center;
border:.5pt solid windowtext;
background:#1F4E79;
mso-pattern:#1F4E79 none;
white-space:normal;}
.xl69
{color:#C55A11;
font-weight:700;
font-family:"Aptos Narrow";
mso-generic-font-family:auto;
mso-font-charset:0;
border:.5pt solid windowtext;
background:#FFE0B2;
mso-pattern:#FFE0B2 none;}
-->
</style>
</head>
<body link="#467886" vlink="#96607D">
Transisitive dependency | Direct dependency | version | Latest Available Version | Latest Version Published Date
-- | -- | -- | -- | --
bytes.js 3.1.2 | expressjs/express | 5.2.1 | 3.1.2 | 2022-01-28
call-bound 1.0.4 | expressjs/express | 5.2.1 | 1.0.4 | 2025-03-03
debug-js/debug 4.4.3 | expressjs/express | 5.2.1 | 4.4.3 | 2025-09-13
ee-first 1.1.1 | expressjs/express | 5.2.1 | 1.1.1 | 2015-05-25
encodeurl 2.0.0 | expressjs/express | 5.2.1 | 2.0.0 | 2024-03-29
escape-html 1.0.3 | expressjs/express | 5.2.1 | 1.0.3 | 2015-09-01
es-define-property 1.0.1 | expressjs/express | 5.2.1 | 1.0.1 | 2024-12-06
etag 1.8.1 | expressjs/express | 5.2.1 | 1.8.1 | 2017-09-13
expressjs/accepts 2.0.0 | expressjs/express | 5.2.1 | 2.0.0 | 2024-09-10
forwarded 0.2.0 | expressjs/express | 5.2.1 | 0.2.0 | 2021-05-31
http-errors 2.0.1 | expressjs/express | 5.2.1 | 2.0.1 | 2025-11-20
inherits v2.0.4 | expressjs/express | 5.2.1 | 2.0.4 | 2019-06-19
isaacs/once 1.4.0 | expressjs/express | 5.2.1 | 1.4.0 | 2016-09-06
ispromise 4.0.0 | expressjs/express | 5.2.1 | 4.0.0 | 2020-04-27
jshttp/content-type 1.0.5 | expressjs/express | 5.2.1 | 1.0.5 | 2023-01-29
jshttp/fresh 2.0.0 | expressjs/express | 5.2.1 | 2.0.0 | 2024-09-04
JSHTTP's negotiator 1.0.0 | expressjs/express | 5.2.1 | 1.0.0 | 2024-08-31
media-typer 1.1.0 | expressjs/express | 5.2.1 | 1.1.0 | 2026-05-27
merge-descriptors 2.0.0 | expressjs/express | 5.2.1 | 2.0.0 | 2023-11-16
mime-db 1.54.0 | expressjs/express | 5.2.1 | 1.54.0 | 2025-03-18
node-cookie-signature 1.2.2 | expressjs/express | 5.2.1 | 1.2.2 | 2024-10-29
nodejs Deprecate 2.0.0 | expressjs/express | 5.2.1 | 2.0.0 | 2018-10-26
object-inspect 1.13.4 | expressjs/express | 5.2.1 | 1.13.4 | 2025-02-05
on-finished 2.4.1 | expressjs/express | 5.2.1 | 2.4.1 | 2022-02-22
pillarjs/parseurl 1.3.3 | expressjs/express | 5.2.1 | 1.3.3 | 2019-04-16
proxy-addr 2.0.7 | expressjs/express | 5.2.1 | 2.0.7 | 2021-06-01
router 2.2.0 | expressjs/express | 5.2.1 | 2.2.0 | 2025-03-27
setprototypeof 1.2.0 | expressjs/express | 5.2.1 | 1.2.0 | 2019-07-18
side-channel-map 1.0.1 | expressjs/express | 5.2.1 | 1.0.1 | 2024-12-10
side-channel-weakmap 1.0.2 | expressjs/express | 5.2.1 | 1.0.2 | 2024-12-11
statuses 2.0.2 | expressjs/express | 5.2.1 | 2.0.2 | 2025-06-06
toidentifier 1.0.1 | expressjs/express | 5.2.1 | 1.0.1 | 2021-11-14
unpipe 1.0.0 | expressjs/express | 5.2.1 | 1.0.0 | 2015-06-14
wrappy 1.0.2 | expressjs/express | 5.2.1 | 1.0.2 | 2016-05-17
cookie 0.7.2 | expressjs/express | 5.2.1 | 1.0.2 | 2024-11-20
range-parser v1.2.1 | expressjs/express | 5.2.1 | 1.3.0 | 2026-06-25
side-channel 1.1.0 | expressjs/express | 5.2.1 | 1.1.1 | 2026-06-08
whitequark/ipaddr.js v1.9.1 | expressjs/express | 5.2.1 | 2.4.0 | 2026-08-03
</body>
</html>
Atleast I can see below libraries have updates:
<html xmlns:v="urn:schemas-microsoft-com:vml"
xmlns:o="urn:schemas-microsoft-com:office:office"
xmlns:x="urn:schemas-microsoft-com:office:excel"
xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta name=ProgId content=Excel.Sheet>
<meta name=Generator content="Microsoft Excel 15">
<link id=Main-File rel=Main-File
href="file:////Users/I076029/Library/Group%20Containers/UBF8T346G9.Office/TemporaryItems/msohtmlclip/clip.htm">
<link rel=File-List
href="file:////Users/I076029/Library/Group%20Containers/UBF8T346G9.Office/TemporaryItems/msohtmlclip/clip_filelist.xml">
<style>
<!--table
{mso-displayed-decimal-separator:"\.";
mso-displayed-thousand-separator:"\,";}
@page
{margin:.75in .7in .75in .7in;
mso-header-margin:.3in;
mso-footer-margin:.3in;}
tr
{mso-height-source:auto;}
col
{mso-width-source:auto;}
br
{mso-data-placement:same-cell;}
td
{padding-top:1px;
padding-right:1px;
padding-left:1px;
mso-ignore:padding;
color:black;
font-size:12.0pt;
font-weight:400;
font-style:normal;
text-decoration:none;
font-family:"Aptos Narrow", sans-serif;
mso-font-charset:0;
mso-number-format:General;
text-align:general;
vertical-align:bottom;
border:none;
mso-background-source:auto;
mso-pattern:auto;
mso-protection:locked visible;
white-space:nowrap;
mso-rotate:0;}
.xl65
{color:#467886;
text-decoration:underline;
text-underline-style:single;
border:.5pt solid windowtext;}
-->
</style>
</head>
cookie 0.7.2
range-parser v1.2.1
side-channel 1.1.0
whitequark/ipaddr.js v1.9.1
</body>
</html>
<!-- The process for bug fixing is:
- We will first assess if the behavior is different from what should occur
- Confirm the bug is reproducible
- Discuss how to best fix the bug
- Work towards a fix
-->
## Environment information
**Version**: 5.2.1
**Platform**: Darwin D3KVF2TL2P 25.6.0 Darwin Kernel Version 25.6.0: Sat Jul 11 15:27:27 PDT 2026; root:xnu-12377.161.13~4/RELEASE_ARM64_T6041 arm64
**Node.js version**: 24.16.0
**Any other relevant information**: Please update express with latest FOSS libraries if available, if not available then please try to replace them with some suitable libraries
## What steps will reproduce the bug?
Please update express with latest FOSS libraries if available, if not available then please try to replace them with some suitable libraries
关闭于 9 天前 2 条评论