High severity - Asymmetric Resource Consumption (Amplification) vulnerability in body-parser (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: body-parser
• Introduced through: juice-shop@12.3.0 and body-parser@1.19.1

Detailed paths

• Introduced through: juice-shop@12.3.0 › body-parser@1.19.1
• Introduced through: juice-shop@12.3.0 › express@4.17.2 › body-parser@1.19.1

Overview

Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) via the extendedparser and urlencoded functions when the URL encoding process is enabled. An attacker can flood the server with a large number of specially crafted requests.

Remediation

Upgrade body-parser to version 1.20.3 or higher.

References

• GitHub Commit
  
  SNYK-JS-BODYPARSER-7926860
  (CVE-2024-45590) body-parser@1.19.1