Generated on May 23, 2024 via pnpm

Npm

Home

okta-for-static-site 1.0.21

Use this npm module to serve your static site behind Okta Single Sign On

okta

static

site

server

cli

saml

Package summary

issues

licenses

Package created

3 Apr 2016

Version published

9 Apr 2016

Maintainers

Total deps

155

Direct deps

License

MIT

Issues

8 critical severity issues

critical

ejs@0.8.8

ejs template injection vulnerability

Recommendation: Upgrade to version 3.1.7 or later

via: passport-saml@0.15.0

xmldom@0.1.19

xmldom allows multiple root nodes in a DOM

Recommendation: None

via: passport-saml@0.15.0

ejs@0.8.8

ejs is vulnerable to remote code execution due to weak input validation

Recommendation: Upgrade to version 2.5.5 or later

via: passport-saml@0.15.0

minimist@0.0.10

Prototype Pollution in minimist

Recommendation: Upgrade to version 0.2.4 or later

via: optimist@0.6.1

lodash@3.2.0

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.12 or later

via: passport-saml@0.15.0

ejs@0.8.8

Package has no specified license

Recommendation: Check the package code and files for license information

via: passport-saml@0.15.0

node-forge@0.2.24

Package has no specified license

Recommendation: Check the package code and files for license information

via: passport-saml@0.15.0

pause@0.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: passport@0.3.2

Collapse

Expand

17 high severity issues

high

xml-crypto@0.8.5

xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

Recommendation: Upgrade to version 2.0.0 or later

via: passport-saml@0.15.0

passport-saml@0.15.0

Signature bypass via multiple root elements

Recommendation: Upgrade to version 3.2.2 or later

via: passport-saml@0.15.0

redis@2.8.0

Node-Redis potential exponential regex in monitor mode

Recommendation: Upgrade to version 3.1.1 or later

via: connect-redis@3.4.2

ejs@0.8.8

ejs vulnerable to DoS due to weak input validation

Recommendation: Upgrade to version 2.5.5 or later

via: passport-saml@0.15.0

lodash@3.2.0

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: passport-saml@0.15.0

node-forge@0.2.24

Prototype Pollution in node-forge

Recommendation: Upgrade to version 0.10.0 or later

via: passport-saml@0.15.0

node-forge@0.2.24

Improper Verification of Cryptographic Signature in node-forge

Recommendation: Upgrade to version 1.3.0 or later

via: passport-saml@0.15.0

node-forge@0.2.24

Improper Verification of Cryptographic Signature in node-forge

Recommendation: Upgrade to version 1.3.0 or later

via: passport-saml@0.15.0

lodash@3.2.0

Command Injection in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: passport-saml@0.15.0

optimist@0.6.1

Package uses an invalid SPDX license ("MIT/X11")

Recommendation: Validate that the package complies with your license policy

via: optimist@0.6.1

spdx-exceptions@2.5.0

Package uses an atypical license ("CC-BY-3.0")

Recommendation: Read and validate the license terms

via: yargs@4.8.1

xmldom@0.1.19

Package uses an invalid SPDX license ("LGPL")

Recommendation: Validate that the package complies with your license policy

via: passport-saml@0.15.0

xpath@0.0.5

Package uses an invalid SPDX license ("MIT License")

Recommendation: Validate that the package complies with your license policy

via: passport-saml@0.15.0

ejs@0.8.8

Deprecated package

via: passport-saml@0.15.0

passport-saml@0.15.0

Deprecated package

via: passport-saml@0.15.0

xmldom@0.1.19

Deprecated package

via: passport-saml@0.15.0

xmldom@0.1.31

Deprecated package

via: passport-saml@0.15.0

Collapse

Expand

15 moderate severity issues

moderate

lodash@3.2.0

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.11 or later

via: passport-saml@0.15.0

node-forge@0.2.24

Improper Verification of Cryptographic Signature in `node-forge`

Recommendation: Upgrade to version 1.3.0 or later

via: passport-saml@0.15.0

yargs-parser@2.4.1

yargs-parser Vulnerable to Prototype Pollution

Recommendation: Upgrade to version 5.0.1 or later

via: yargs@4.8.1

xmldom@0.1.19

Misinterpretation of malicious XML input

Recommendation: Upgrade to version 0.5.0 or later

via: passport-saml@0.15.0

ejs@0.8.8

mde ejs vulnerable to XSS

Recommendation: Upgrade to version 2.5.5 or later

via: passport-saml@0.15.0

passport@0.3.2

Passport vulnerable to session regeneration when a users logs in or out

Recommendation: Upgrade to version 0.6.0 or later

via: passport@0.3.2

node-forge@0.2.24

Open Redirect in node-forge

Recommendation: Upgrade to version 1.0.0 or later

via: passport-saml@0.15.0

lodash@3.2.0

Regular Expression Denial of Service (ReDoS) in lodash

Recommendation: Upgrade to version 4.17.21 or later

via: passport-saml@0.15.0

passport-saml@0.15.0

Unlimited transforms allowed for signed nodes

Recommendation: Upgrade to version 3.1.0 or later

via: passport-saml@0.15.0

minimist@0.0.10

Prototype Pollution in minimist

Recommendation: Upgrade to version 0.2.1 or later

via: optimist@0.6.1

xmldom@0.1.19

Misinterpretation of malicious XML input

Recommendation: None

via: passport-saml@0.15.0

xml2js@0.4.23

xml2js is vulnerable to prototype pollution

Recommendation: Upgrade to version 0.5.0 or later

via: passport-saml@0.15.0

lodash@3.2.0

Prototype Pollution in lodash

Recommendation: Upgrade to version 4.17.5 or later

via: passport-saml@0.15.0

ejs@0.8.8

ejs lacks certain pollution protection

Recommendation: Upgrade to version 3.1.10 or later

via: passport-saml@0.15.0

pause@0.0.1

Package has no specified source code repository

via: passport@0.3.2

Collapse

Expand

8 low severity issues

low

node-forge@0.2.24

Prototype Pollution in node-forge debug API.

Recommendation: Upgrade to version 1.0.0 or later

via: passport-saml@0.15.0

node-forge@0.2.24

Prototype Pollution in node-forge util.setPath API

Recommendation: Upgrade to version 0.10.0 or later

via: passport-saml@0.15.0

node-forge@0.2.24

URL parsing in node-forge could lead to undesired behavior.

Recommendation: Upgrade to version 1.0.0 or later

via: passport-saml@0.15.0

optimist@0.6.1

Package uses a license that is not OSI approved ("MIT/X11")

Recommendation: Read and validate the license terms

via: optimist@0.6.1

spdx-exceptions@2.5.0

Package uses a license that is not OSI approved ("CC-BY-3.0")

Recommendation: Read and validate the license terms

via: yargs@4.8.1

spdx-license-ids@3.0.17

Package uses a license that is not OSI approved ("CC0-1.0")

Recommendation: Read and validate the license terms

via: yargs@4.8.1

xmldom@0.1.19

Package uses a license that is not OSI approved ("LGPL")

Recommendation: Read and validate the license terms

via: passport-saml@0.15.0

xpath@0.0.5

Package uses a license that is not OSI approved ("MIT License")

Recommendation: Read and validate the license terms

via: passport-saml@0.15.0

Collapse

Expand

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

129 Packages, Including:

accepts@1.3.8

ansi-regex@2.1.1

array-flatten@1.1.1

async@0.2.10

body-parser@1.20.2

bytes@3.0.0

bytes@3.1.2

call-bind@1.0.7

camelcase@3.0.0

code-point-at@1.1.0

compressible@2.0.18

compression@1.7.4

connect-redis@3.4.2

content-disposition@0.5.4

content-type@1.0.5

cookie-parser@1.4.6

cookie-signature@1.0.6

cookie-signature@1.0.7

cookie@0.4.1

cookie@0.6.0

debug@2.6.9

debug@4.3.4

decamelize@1.2.0

define-data-property@1.1.4

depd@2.0.0

destroy@1.2.0

double-ended-queue@2.1.0-0

ee-first@1.1.1

encodeurl@1.0.2

error-ex@1.3.2

es-define-property@1.0.0

es-errors@1.3.0

escape-html@1.0.3

etag@1.8.1

express-session@1.18.0

express@4.19.2

finalhandler@1.2.0

find-up@1.1.2

forwarded@0.2.0

fresh@0.5.2

function-bind@1.1.2

get-intrinsic@1.2.4

gopd@1.0.1

has-property-descriptors@1.0.2

has-proto@1.0.3

has-symbols@1.0.3

hasown@2.0.2

http-errors@2.0.0

iconv-lite@0.4.24

invert-kv@1.0.0

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

13 Packages, Including:

cliui@3.2.0

get-caller-file@1.0.3

graceful-fs@4.2.11

hosted-git-info@2.8.9

inherits@2.0.4

require-main-filename@1.0.1

sax@1.3.0

semver@5.7.2

set-blocking@2.0.0

setprototypeof@1.2.0

which-module@1.0.0

y18n@3.2.2

yargs-parser@2.4.1

N/A

3 Packages, Including:

ejs@0.8.8

node-forge@0.2.24

pause@0.0.1

Apache License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

use-patent-claims

place-warranty

Cannot

hold-liable

use-trademark

Must

include-copyright

include-license

state-changes

include-notice

2 Packages, Including:

spdx-correct@3.2.0

validate-npm-package-license@3.0.4

BSD 2-Clause "Simplified" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

normalize-package-data@2.5.0

MIT/X11

Invalid

Not OSI Approved

1 Packages, Including:

optimist@0.6.1

BSD 3-Clause "New" or "Revised" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

qs@6.11.0

Creative Commons Attribution 3.0 Unported

Uncategorized

Not OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

Cannot

Must

1 Packages, Including:

spdx-exceptions@2.5.0

Creative Commons Zero v1.0 Universal

Public Domain

Not OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

Cannot

Must

1 Packages, Including:

spdx-license-ids@3.0.17

LGPL

Invalid

Not OSI Approved

1 Packages, Including:

xmldom@0.1.19

(LGPL-2.0 or MIT)

Permissive

1 Packages, Including:

xmldom@0.1.31

MIT License

Invalid

Not OSI Approved

1 Packages, Including:

xpath@0.0.5

Direct Dependencies

All Dependencies CSV

ⓘ This is a list of okta-for-static-site 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
body-parser	1.20.2	14.75 kB	MIT	prod
compression	1.7.4	7.64 kB	MIT	prod
connect-redis	3.4.2	7.99 kB	MIT	prod	1
cookie-parser	1.4.6	4.2 kB	MIT	prod
express-session	1.18.0	22.25 kB	MIT	prod
express	4.19.2	209.73 kB	MIT	prod
optimist	0.6.1	12.06 kB	MIT/X11	prod	1 1 1 1
passport-saml	0.15.0	77.32 kB	MIT	prod	6 14 11 5
passport	0.3.2	10 kB	MIT	prod	1 2
yargs	4.8.1	51.85 kB	MIT	prod	1 1 2