Description
This is a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don’t. Any code calling these functions will be written thinking they would limit the concurrency but they won’t. This could lead to potential security issues in other projects.
Recommendation
Update the modern-async package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.0.4
- Patched version(s): 1.0.4
References
Could your website be exposed too?
SmartScanner can check your website for modern-async's `forEachSeries` and `forEachLimit` functions do not limit the number of requests and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prototype Pollution in async - CVE-2021-43138
- Insecure random number generation in keypair - CVE-2021-41117
- Utils.readChallengeTx does not verify the server account signature - CVE-2021-32738
- When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id - CVE-2023-35167
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023