GHSA-hrpp-f84w-xhfgMediumCVSS 5.3Disclosed before NVD

Outdated Static Dependency in vue-moment

Published
September 4, 2020
Last Modified
January 9, 2023

📋 Description

Versions of vue-moment prior to 4.1.0 contain an Outdated Static Dependency. The package depends on moment and has it loaded statically instead of as a dependency that can be updated. It has [email protected] that contains a Regular Expression Denial of Service vulnerability.

Recommendation

Upgrade to version 4.1.0 or later.

🎯 Affected products1

  • npm/vue-moment:< 4.1.0

🔗 References (5)