WS-2021-0131

constructEvent does not verify headers in @worker-tools/stripe-webhook before 1.1.4...

constructEvent does not verify header

Impact Anyone verifying a Stripe webhook request via this library's constructEvent function. Patches Upgrade to 1.1.4. Workarounds Use await verifyHeader... directly instead of constructEvent. References https://github.com/worker-tools/stripe-webhook/issues/1...

PT-2021-24377

Name of the Vulnerable Software and Affected Versions: stripe-webhook versions prior to 1.1.4 Description: The issue affects users who verify Stripe webhook requests using the constructEvent function. There is no information about the estimated number of potentially affected devices or real-world...