Security: Multiple known vulnerable dependencies (CVE-2022-23529, CVE-2023-3696, CVE-2024-43796, CVE-2022-31129)

Security Advisory

This project includes four dependencies with known critical and high-severity vulnerabilities.

1. jsonwebtoken@^8.5.1 — CVE-2022-23529 (Critical)

JWT verification bypass allowing token forgery.

• Fix: Upgrade to jsonwebtoken >= 9.0.0
• Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-23529

2. mongoose@^5.7.7 — CVE-2023-3696 (Critical)

Prototype pollution via crafted query objects.

• Fix: Upgrade to mongoose >= 6.9.1
• Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-3696

3. express@^4.17.1 — CVE-2024-43796 (Medium)

XSS via response.redirect() with unsanitized user input.

• Fix: Upgrade to express >= 4.21.1
• Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-43796

4. moment@^2.24.0 — CVE-2022-31129 (High)

ReDoS when parsing user-supplied date strings.

• Fix: Upgrade to moment >= 2.29.4
• Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-31129

Recommendation

Update affected dependencies in package.json to their patched versions.