GMS-2019-64: Denial of Service in url-relative

June 5, 2019 (updated August 4, 2021)

All versions of url-relative are vulnerable to Denial of Service. If the values to and from are equal, the function hangs and never returns. This may cause a Denial of Service. No fix is currently available. Consider using an alternative module until a fix is made available.

References

github.com/advisories/GHSA-86p3-4gfq-38f2
github.com/junosuarez/url-relative/issues/3
snyk.io/vuln/SNYK-JS-URLRELATIVE-173691
www.npmjs.com/advisories/783

Code Behaviors & Features

Detect and mitigate GMS-2019-64 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →