Packages / find-my-way / Security

ModerateVulnerabilityGHSA-jgrh-5m3h-9c5fCVE-2020-7764SNYK-JS-FINDMYWAY-1038269Published 9 Nov 2020

Web Cache Poisoning in find-my-way

Your version

Affected releases · find-my-way

  • 3.x3.0.0 – 3.0.4Fixed in 3.0.5
  • 2.x2.0.0 – 2.2.4Fixed in 2.2.5
  • 1.x and older0.0.1 – 1.18.1No fix, no longer updated

On 3.x, the newest line:

npm install find-my-way@3.0.5
Every release on a timeline
9.x

  1. Not affected

    9.0.0 – 9.10.0

    12 releases, latest

3.x

  1. Affected

    3.0.0 – 3.0.4

    5 releases

  2. Fixed

    3.0.5

    1 release

2.x

  1. Affected

    2.0.0 – 2.2.4

    10 releases

  2. Fixed

    2.2.5

    1 release

1.x

  1. Affected

    1.0.0 – 1.18.1

    42 releases

0.x

  1. Affected

    0.0.1 – 0.2.4

    7 releases

121 stable releases of find-my-way, oldest to newest, one row per major.

What happens

This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.