@outfoxx/sunday (1.1.0-alpha.19) potentially affected by CVE-2021-43309 via uri-template-lite (22.1.0)

uri-template-lite NPM version 22.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on uri-template-lite and may be impacted: - @outfoxx/sunday 1.1.0-alpha.19 Source cves: CVE-2021-43309 Source advisory: OSV:GHSA-CHW2-6C7R-37P7...

CVE-2021-43309

CVE-2021-43309 affects the uri-template-lite npm package. The root cause is an insecure regular expression (expandRe) in index.js used by URI.expand, enabling exponential ReDoS when attacker-controlled input is supplied. Impact is denial of service affecting availability. Public exploit details a...