1405_logging (1.0.0), @airy/maleo (>=0.0.1-canary.49, <=0.3.1-canary.36) +300 more potentially affected by unknown CVE via helmet-csp (>=1.2.2, <=2.9.0)

helmet-csp NPM version =1.2.2, =0.0.1-canary.49, =0.1.0, =1.0.22, =0.1.1-alpha.0, =0.1.0, =1.5.0, =0.1.0-alpha1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-C3M8-X3CG-QM2C...

Configuration Override in helmet-csp

Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy CSP. The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application'...

GHSA-C3M8-X3CG-QM2C Configuration Override in helmet-csp

Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy CSP. The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application'...

Configuration Override

Overview Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy CSP. The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an...