An open API service providing security vulnerability metadata for many open source software ecosystems.
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| npm:vue-moment | < 4.1.0 | 4.1.0 | |
Affected Version RangesAll affected versions1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.2.0, 3.0.0, 3.1.0, 3.2.0, 4.0.0 All unaffected versions4.1.0 |
|||
Versions of vue-moment prior to 4.1.0 contain an Outdated Static Dependency. The package depends on moment and has it loaded statically instead of as a dependency that can be updated. It has [email protected] that contains a Regular Expression Denial of Service vulnerability.
Upgrade to version 4.1.0 or later.
References: