WS-2020-0038

Versions of @commercial/subtext prior to 5.1.2 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

WS-2020-0031

Version 5.1.1 of @commercial/subtext is vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to catching expecte...

Denial of Service in @commercial/subtext

Versions of @commercial/subtext prior to 5.1.1 are vulnerable to Denial of Service DoS. The package fails to enforce the maxBytes configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may...

GHSA-36C4-4R89-6WHG Prototype Pollution in @commercial/subtext

Versions of @commercial/subtext prior to 5.1.2 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which...

GHSA-CVFM-XJC8-F2VM Denial of Service in @commercial/subtext

Version 5.1.1 of @commercial/subtext is vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to catching expecte...

PT-2020-21254

Name of the Vulnerable Software and Affected Versions @commercial/subtext version 5.1.1 Description The Content-Encoding HTTP header parser in the @commercial/subtext module has a vulnerability that can cause a system error when encountering invalid values in the header. This error can lead to th...

PT-2020-20978

Name of the Vulnerable Software and Affected Versions @commercial/subtext versions prior to 5.1.2 Description The issue allows a multipart payload to be constructed in a way that one of the parts' content can be set as the entire payload object's prototype. If this prototype contains data, it may...

PT-2020-21284

Name of the Vulnerable Software and Affected Versions @commercial/subtext versions prior to 5.1.1 Description The issue allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service. This is due to the package's failure to enforce...