Skip to content
Fencer Intel
high —

GHSA-4j6x-w426-6rc6 json

Default Express middleware security check is ignored in production

published 7y ago modified 6y ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

## Default Express middleware security check is ignored in production

### Impact All Cube.js deployments that use affected versions of `@cubejs-backend/api-gateway` with default express authentication middleware in production environment are affected.

### Patches @cubejs-backend/api-gateway@0.11.17

### Workarounds Override default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware

### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/cube-js/cube.js/issues * Reach out us in community Slack: https://slack.cube.dev/

Patch / fix

  • npm @cubejs-backend/api-gateway 0.11.17

Is GHSA-4j6x-w426-6rc6 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm @cubejs-backend/api-gateway
>=0.11.0, <0.11.17
0.11.17

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.