Moment dependency vulnerability

[loujaybee]

11:26:43 [INFO] > nsp "check"
11:26:43 [INFO] 
11:26:48 [INFO] (+) 1 vulnerability found
11:26:48 [INFO] ┌────────────┬────────────────────────────────────────────────────────────────────┐
11:26:48 [INFO] │            │ Regular Expression Denial of Service                               │
11:26:48 [INFO] ├────────────┼────────────────────────────────────────────────────────────────────┤
11:26:48 [INFO] │ Name       │ moment                                                             │
11:26:48 [INFO] ├────────────┼────────────────────────────────────────────────────────────────────┤
11:26:48 [INFO] │ CVSS       │ 7.5 (High)                                                         │
11:26:48 [INFO] ├────────────┼────────────────────────────────────────────────────────────────────┤
11:26:48 [INFO] │ Installed  │ 2.18.1                                                             │
11:26:48 [INFO] ├────────────┼────────────────────────────────────────────────────────────────────┤
11:26:48 [INFO] │ Vulnerable │ <2.19.3                                                            │
11:26:48 [INFO] ├────────────┼────────────────────────────────────────────────────────────────────┤
11:26:48 [INFO] │ Patched    │ >=2.19.3                                                           │
11:26:48 [INFO] ├────────────┼────────────────────────────────────────────────────────────────────┤
11:26:48 [INFO] │ Path       │ cpp-ui-spa-master@0.0.1 > chart.js@2.7.1 > moment@2.18.1           │
11:26:48 [INFO] ├────────────┼────────────────────────────────────────────────────────────────────┤
11:26:48 [INFO] │ More Info  │ https://nodesecurity.io/advisories/532                             │
11:26:48 [INFO] └────────────┴────────────────────────────────────────────────────────────────────┘

Expected Behavior

Should not raise moment dependency issue.

Current Behavior

Breaking dependency.

Possible Solution

Update package.json to ensure higher version dependency.

Steps to Reproduce (for bugs)

1. Install chart.js
2. install nsp
3. run nsp "check"

Context

If not, this requires forcing the dependency in the application.

Environment

See above error report.

[simonbrunel]

This has been fixed by #4891 but not released yet (2.7.2)

Duplicates #5024 and #5130