Hold on, we're currently generating a fresh version of this report

Generated on May 22, 2024 via pnpm

image-resizer 0.7.2

On-the-fly image resizing and optimization using node and graphicsmagick. Heroku ready!

Package summary

109

issues

7

licenses

Package created

18 May 2014

Version published

16 Jun 2014

Maintainers

1

Total deps

232

Direct deps

17

License

MIT

Issues

109

23 critical severity issues

gm@1.14.2

Command Injection in gm

Recommendation: Upgrade to version 1.21.1 or later

via: gm@1.14.2

decompress@0.2.5

Path Traversal in decompress

Recommendation: Upgrade to version 4.2.1 or later

via: imagemin@0.4.9

underscore@1.7.0

Arbitrary Code Execution in underscore

Recommendation: Upgrade to version 1.12.1 or later

via: imagemin@0.4.9

lodash@2.4.2

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.12 or later

via: lodash@2.4.2

asn1@0.1.11

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9 & others

assert-plus@0.1.5

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9 & others

aws-sign2@0.5.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9 & others

colors@0.6.2

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9

combined-stream@0.0.7

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9 & others

ctype@0.5.3

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9 & others

debug@0.7.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: gm@1.14.2

debug@0.7.4

Package has no specified license

Recommendation: Check the package code and files for license information

via: knox@0.8.10

delayed-stream@0.0.5

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9 & others

forever-agent@0.5.2

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9 & others

map-stream@0.1.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: map-stream@0.1.0

mime@1.2.11

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9 & others

oauth-sign@0.3.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9 & others

qs@0.6.6

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9 & others

tunnel-agent@0.3.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9 & others

twit@1.1.20

Package has no specified license

Recommendation: Check the package code and files for license information

via: twit@1.1.20

uuid@1.4.2

Package has no specified license

Recommendation: Check the package code and files for license information

via: imagemin@0.4.9

xml2js@0.2.6

Package has no specified license

Recommendation: Check the package code and files for license information

via: aws-sdk@2.0.31

xml2js@0.2.8

Package has no specified license

Recommendation: Check the package code and files for license information

via: knox@0.8.10

56 high severity issues

qs@0.6.6

Prototype Pollution Protection Bypass in qs

Recommendation: Upgrade to version 6.0.4 or later

via: imagemin@0.4.9 & others

aws-sdk@2.0.31

Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader

Recommendation: Upgrade to version 2.814.0 or later

via: aws-sdk@2.0.31

tar@0.1.20

Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

Recommendation: Upgrade to version 3.2.2 or later

via: imagemin@0.4.9

qs@0.6.6

Denial-of-Service Extended Event Loop Blocking in qs

Recommendation: Upgrade to version 1.0.0 or later

via: imagemin@0.4.9 & others

tar@0.1.20

Symlink Arbitrary File Overwrite in tar

Recommendation: Upgrade to version 2.0.0 or later

via: imagemin@0.4.9

hawk@1.0.0

Regular Expression Denial of Service in hawk

Recommendation: Upgrade to version 3.1.3 or later

via: imagemin@0.4.9 & others

qs@0.6.6

Denial-of-Service Memory Exhaustion in qs

Recommendation: Upgrade to version 1.0.0 or later

via: imagemin@0.4.9 & others

minimatch@0.3.0

Regular Expression Denial of Service in minimatch

Recommendation: Upgrade to version 3.0.2 or later

via: glob@3.2.11

mime@1.2.11

mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input

Recommendation: Upgrade to version 1.4.1 or later

via: imagemin@0.4.9 & others

hoek@0.9.1

Prototype Pollution in hoek

Recommendation: Upgrade to version 4.2.1 or later

via: imagemin@0.4.9 & others

debug@0.7.0

debug Inefficient Regular Expression Complexity vulnerability

Recommendation: Upgrade to version 2.6.9 or later

via: gm@1.14.2 & others

lodash@2.4.2

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: lodash@2.4.2

fstream@0.1.31

Arbitrary File Overwrite in fstream

Recommendation: Upgrade to version 1.0.12 or later

via: imagemin@0.4.9

js-yaml@2.1.3

Code Injection in js-yaml

Recommendation: Upgrade to version 3.13.1 or later

via: imagemin@0.4.9

hawk@1.0.0

Uncontrolled Resource Consumption in Hawk

Recommendation: Upgrade to version 9.0.1 or later

via: imagemin@0.4.9 & others

tar@0.1.20

Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization

Recommendation: Upgrade to version 4.4.18 or later

via: imagemin@0.4.9

tar@0.1.20

Arbitrary File Overwrite in tar

Recommendation: Upgrade to version 2.2.2 or later

via: imagemin@0.4.9

hoek@0.9.1

hoek subject to prototype pollution via the clone function.

Recommendation: None

via: imagemin@0.4.9 & others

qs@0.6.6

qs vulnerable to Prototype Pollution

Recommendation: Upgrade to version 6.2.4 or later

via: imagemin@0.4.9 & others

minimatch@0.3.0

minimatch ReDoS vulnerability

Recommendation: Upgrade to version 3.0.5 or later

via: glob@3.2.11

lodash@2.4.2

Command Injection in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: lodash@2.4.2

boom@0.4.2

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9 & others

cryptiles@0.2.2

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9 & others

esprima@1.0.4

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9

fstream@0.1.31

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9

gifsicle@0.1.7

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9

glob@3.2.11

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: glob@3.2.11

hawk@1.0.0

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9 & others

hoek@0.9.1

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9 & others

jpegtran-bin@0.2.8

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9

optipng-bin@0.3.11

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9

sax@0.5.8

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: knox@0.8.10

sax@0.6.1

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9

sntp@0.2.4

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9 & others

stream-counter@0.1.0

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: knox@0.8.10

tar@0.1.20

Package uses an invalid SPDX license ("BSD")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9

aws-sdk@2.0.31

Package uses an invalid SPDX license ("Apache 2.0")

Recommendation: Validate that the package complies with your license policy

via: aws-sdk@2.0.31

request@2.34.0

Package uses an invalid SPDX license ("Apache, Version 2.0")

Recommendation: Validate that the package complies with your license policy

via: imagemin@0.4.9 & others

boom@0.4.2

Deprecated package

via: imagemin@0.4.9 & others

cryptiles@0.2.2

Deprecated package

via: imagemin@0.4.9 & others

find-file@0.1.4

Deprecated package

via: imagemin@0.4.9

gifsicle@0.1.7

Package uses postinstall script: "node index.js"

via: imagemin@0.4.9

hawk@1.0.0

Deprecated package

via: imagemin@0.4.9 & others

hoek@0.9.1

Deprecated package

via: imagemin@0.4.9 & others

jpegtran-bin@0.2.8

Package uses postinstall script: "node index.js"

via: imagemin@0.4.9

minimatch@0.3.0

Deprecated package

via: glob@3.2.11

mkdirp@0.3.5

Deprecated package

via: imagemin@0.4.9

node-uuid@1.4.8

Deprecated package

via: imagemin@0.4.9 & others

optipng-bin@0.3.11

Package uses postinstall script: "node index.js"

via: imagemin@0.4.9

pngquant-bin@0.3.5

Package uses postinstall script: "node index.js"

via: imagemin@0.4.9

request@2.34.0

Deprecated package

via: imagemin@0.4.9 & others

sntp@0.2.4

Deprecated package

via: imagemin@0.4.9 & others

static-favicon@2.0.0-alpha

Deprecated package

via: static-favicon@2.0.0-alpha

svgo@0.4.5

Deprecated package

via: imagemin@0.4.9

tar@0.1.20

Deprecated package

via: imagemin@0.4.9

uuid@1.4.2

Deprecated package

via: imagemin@0.4.9

12 moderate severity issues

lodash@2.4.2

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: lodash@2.4.2

underscore.string@2.3.3

Regular Expression Denial of Service in underscore.string

Recommendation: Upgrade to version 3.3.5 or later

via: imagemin@0.4.9

js-yaml@2.1.3

Denial of Service in js-yaml

Recommendation: Upgrade to version 3.13.0 or later

via: imagemin@0.4.9

tunnel-agent@0.3.0

Memory Exposure in tunnel-agent

Recommendation: Upgrade to version 0.6.0 or later

via: imagemin@0.4.9 & others

got@0.2.0

Got allows a redirect to a UNIX socket

Recommendation: Upgrade to version 11.8.5 or later

via: imagemin@0.4.9

request@2.34.0

Remote Memory Exposure in request

Recommendation: Upgrade to version 2.68.0 or later

via: imagemin@0.4.9 & others

lodash@2.4.2

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: lodash@2.4.2

xml2js@0.2.6

xml2js is vulnerable to prototype pollution

Recommendation: Upgrade to version 0.5.0 or later

via: aws-sdk@2.0.31 & others

request@2.34.0

Server-Side Request Forgery in Request

Recommendation: None

via: imagemin@0.4.9 & others

tar@0.1.20

Denial of service while parsing a tar file due to lack of folders count validation

Recommendation: Upgrade to version 6.2.1 or later

via: imagemin@0.4.9

lodash@2.4.2

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.5 or later

via: lodash@2.4.2

debug@0.7.0

Package has no specified source code repository

via: gm@1.14.2

18 low severity issues

debug@0.7.0

Regular Expression Denial of Service in debug

Recommendation: Upgrade to version 2.6.9 or later

via: gm@1.14.2 & others

boom@0.4.2

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9 & others

cryptiles@0.2.2

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9 & others

esprima@1.0.4

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9

fstream@0.1.31

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9

gifsicle@0.1.7

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9

glob@3.2.11

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: glob@3.2.11

hawk@1.0.0

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9 & others

hoek@0.9.1

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9 & others

jpegtran-bin@0.2.8

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9

optipng-bin@0.3.11

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9

sax@0.5.8

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: knox@0.8.10

sax@0.6.1

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9

sntp@0.2.4

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9 & others

stream-counter@0.1.0

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: knox@0.8.10

tar@0.1.20

Package uses a license that is not OSI approved ("BSD")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9

aws-sdk@2.0.31

Package uses a license that is not OSI approved ("Apache 2.0")

Recommendation: Read and validate the license terms

via: aws-sdk@2.0.31

request@2.34.0

Package uses a license that is not OSI approved ("Apache, Version 2.0")

Recommendation: Read and validate the license terms

via: imagemin@0.4.9 & others

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

177 Packages, Including:

@types/keyv@3.1.4

@types/node@20.12.12

@types/responselike@1.0.3

accepts@1.3.8

adm-zip@0.4.16

ansi-regex@2.1.1

ansi-styles@1.0.0

ansi-styles@2.2.1

argparse@0.1.16

array-flatten@1.1.1

array-parallel@0.1.3

array-series@0.1.5

async@0.9.2

balanced-match@1.0.2

basic-auth@2.0.1

bin-build@0.1.1

bin-check@0.1.5

bin-wrapper@0.3.4

body-parser@1.20.2

brace-expansion@1.1.11

bytes@3.1.2

call-bind@1.0.7

chalk@0.4.0

chalk@1.1.3

coa@0.4.1

commander@2.20.3

concat-map@0.0.1

concat-stream@1.4.11

content-disposition@0.5.4

content-type@1.0.5

cookie-signature@1.0.6

cookie@0.6.0

core-util-is@1.0.3

debug@2.6.9

decompress@0.2.5

define-data-property@1.1.4

depd@2.0.0

destroy@1.2.0

download@0.1.19

duplexer@0.1.2

each-async@0.1.3

ee-first@1.1.1

encodeurl@1.0.2

errorhandler@1.5.1

es-define-property@1.0.0

es-errors@1.3.0

escape-html@1.0.3

escape-string-regexp@1.0.5

etag@1.8.1

exec-buffer@0.1.1

N/A

N/A

19 Packages, Including:

asn1@0.1.11

assert-plus@0.1.5

aws-sign2@0.5.0

colors@0.6.2

combined-stream@0.0.7

ctype@0.5.3

debug@0.7.0

debug@0.7.4

delayed-stream@0.0.5

forever-agent@0.5.2

map-stream@0.1.0

mime@1.2.11

oauth-sign@0.3.0

qs@0.6.6

tunnel-agent@0.3.0

twit@1.1.20

uuid@1.4.2

xml2js@0.2.6

xml2js@0.2.8

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

17 Packages, Including:

abbrev@1.1.1

block-stream@0.0.9

fs.realpath@1.0.0

glob@7.2.3

graceful-fs@3.0.12

inflight@1.0.6

inherits@2.0.4

json-stringify-safe@5.0.1

lru-cache@2.7.3

minimatch@3.1.2

natives@1.1.6

nopt@3.0.6

once@1.4.0

rimraf@2.7.1

setprototypeof@1.2.0

sigmund@1.0.1

wrappy@1.0.2

BSD

Invalid

Not OSI Approved

15 Packages, Including:

boom@0.4.2

cryptiles@0.2.2

esprima@1.0.4

fstream@0.1.31

gifsicle@0.1.7

glob@3.2.11

hawk@1.0.0

hoek@0.9.1

jpegtran-bin@0.2.8

optipng-bin@0.3.11

sax@0.5.8

sax@0.6.1

sntp@0.2.4

stream-counter@0.1.0

tar@0.1.20

BSD 3-Clause "New" or "Revised" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

2 Packages, Including:

qs@6.11.0

tough-cookie@4.1.4

Apache 2.0

Invalid

Not OSI Approved

1 Packages, Including:

aws-sdk@2.0.31

Apache, Version 2.0

Invalid

Not OSI Approved

1 Packages, Including:

request@2.34.0

Direct Dependencies

17

All Dependencies CSV

ⓘ This is a list of image-resizer 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
aws-sdk	2.0.31	231.3 kB	Apache 2.0	prod	1 2 1 1
chalk	0.4.0	2.47 kB	MIT	prod
commander	2.20.3	18.26 kB	MIT	prod
concat-stream	1.4.11	3.53 kB	MIT	prod
errorhandler	1.5.1	5.75 kB	MIT	prod
express	4.19.2	209.73 kB	MIT	prod
glob	3.2.11	16.2 kB	BSD	prod	4 1
gm	1.14.2	23.94 kB	MIT	prod	2 1 1 1
imagemin	0.4.9	2.82 kB	MIT	prod	15 44 7 13
knox	0.8.10	13.14 kB	MIT	prod	2 3 1 3
lodash	2.4.2	192.11 kB	MIT	prod	1 2 3
map-stream	0.1.0	4.93 kB	UNKNOWN	prod	1
mkdirp	0.5.6	2.95 kB	MIT	prod optional
morgan	1.10.0	9.37 kB	MIT	prod
request	2.34.0	21.33 kB	Apache, Version 2.0	prod optional	11 22 3 6
static-favicon	2.0.0-alpha	2.33 kB	MIT	prod	1
twit	1.1.20	52.85 kB	UNKNOWN	prod	1

All Versions