Configuration Override in helmet-csp

Description

Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application’s Content Security Policy (CSP). The package’s browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy.

Recommendation

Update the helmet-csp package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.2.2, < 2.9.1
• Patched version(s): 2.9.1

References

• GHSA-c3m8-x3cg-qm2c
• www.npmjs.com
• snyk.io

Related Issues

• angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend - CVE-2023-28444
• Insecure Default Configuration in redbird - Vulnerability
• Insecure Default Configuration in tesseract.js - Vulnerability
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

helmet-csp