-
-
Notifications
You must be signed in to change notification settings - Fork 26.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Child library nth-check is vulnerable to CVE-2021-3803 even with the latest react-scripts@5.0.1 #12778
Comments
Vulnerable react-scripts 5.0.1 makes our product vulnerable. Please upgrade the react-scripts 5.0.1 at the earliest possible with transitive dependencies security patches. It should have the updated transitive dependency for nth-check by upgrading nth-check/1.0.2 to latest available version nth-check/2.1.1. |
We are having the same issue in our project. Please upgrade this child dependency ASAP. |
A few of our applications are blocked because of this as well. 😢 |
This is also causing me and my team huge problems. |
Do we have some update on this. |
An "Inefficient Regular Expression Complexity" vulnerability is not of any concern in a build tool. Feel safe to waive this security issue. Also look at this pinned post. |
This seems to be a dup of #12146, and would be resolved by #11174, #12026, or #12026 It appears that migrating from v5 to v6 of |
#11174 is the correct answer, just move |
There is a dependent library nth-check in react-scripts which is vulnerable to CVE-2021-3803. The mend scan is reporting this vulnerability for our project.
-- react-scripts@5.0.1
+-- @svgr/webpack@5.5.0
|
-- @svgr/plugin-svgo@5.5.0 |
-- svgo@1.3.2|
-- css-select@2.1.0 |
-- nth-check@1.0.2nth-check beyond v2.0.1(including) is available and safe from this vulnerability.
To fix this we have upgraded to the latest version for react-scripts (as shown above) still this dependency is not upgraded. Can you please take some action and upgrade this transitive dependency inside the parent library react-scripts at the earliest possible.
The text was updated successfully, but these errors were encountered: