Trivy: Node.js package-lock.json : library: lodash v4.17.15, HIGH severity vulnerability id: NSWG-ECO-516 , title : Allocation of Resources Without Limits or Throttling

Created on 11 Jun 2020 · 7Comments · Source: aquasecurity/trivy

Hi guys trivy is detecting this vulnerability in Docker image in package-lock.json for a Node server:
lodash v4.17.15 HIGH NSWG-ECO-516 Allocation of Resources Without Limits or Throttling.
I could not find any info regarding this particular vulnerability and npm audit and snyk is not detecting it , also not even the guys maintaining the lodash library seem to be aware of this vulnerability and I could not find any info about it. Can you point me in the wright direction as to where I can find more info or where the vulnerability has been reported ?

triagsupport

Source

cristianbriscaru

All 7 comments

https://github.com/nodejs/security-wg/commit/166fc1d690daeccb63ab6b2b973bfa3ee3cddcdc

That's the commit where it was added to the NSWG database. Odd that the maintainers have not been notified if it is a severe vulnerability imho, but yeah, that's all the data I can find on it!

Johannestegner on 11 Jun 2020

On further investigation, I figured out that the vulnerability is actually available in snyk too:
https://app.snyk.io/vuln/SNYK-JS-LODASH-567746

It shares the same hackerone link, which seems to have _not_ been fixed in lodash even though a PR have been available since may 7: https://github.com/lodash/lodash/pull/4759

Johannestegner on 11 Jun 2020

👍1

@Johannestegner thank you for the prompt response, I have more than enough info and I will close this issue.

cristianbriscaru on 11 Jun 2020

👍1

@Johannestegner From what I can tell, this issue has been resolved in Lodash v4.17.19, however Trivy is still reporting a HIGH severity vulnerability.

Lodash PR: https://github.com/lodash/lodash/pull/4759
Npm advisory: https://www.npmjs.com/advisories/1523

Please could you let me know if this is the case and if so when the Trivy db will be updated?