What is GHSA-4g53-vp7q-gfjv?

GHSA-4g53-vp7q-gfjv is a security advisory published by GitHub Security Advisories with High severity. constructEvent does not verify header

Why does GHSA-4g53-vp7q-gfjv have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-4g53-vp7q-gfjv?

GHSA-4g53-vp7q-gfjv affects 1 product, including: npm/@worker-tools/stripe-webhook:\u003c 1.1.4.

GHSA-4g53-vp7q-gfjvHighDisclosed before NVD

constructEvent does not verify header

Vendor

GitHub Security Advisories

Published

May 28, 2021

Last Modified

January 9, 2023

📋 Description

Impact

Anyone verifying a Stripe webhook request via this library's constructEvent function.

Patches

Upgrade to 1.1.4.

Workarounds

Use await verifyHeader(...) directly instead of constructEvent.

References

https://github.com/worker-tools/stripe-webhook/issues/1

🎯 Affected products1

npm/@worker-tools/stripe-webhook:< 1.1.4

🔗 References (2)

https://github.com/worker-tools/stripe-webhook/security/advisories/GHSA-4g53-vp7q-gfjv
https://github.com/advisories/GHSA-4g53-vp7q-gfjv