All subtext versions

[email protected] rejected Risk: 43 BSD-3-Clause

subtext @6.0.11

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Homepage Tarball
43
Risk Score
BSD-3-Clause
License
No
Install Scripts
5
Dependencies
3
Dev Dependencies
4.5 KB
Package Size
Published

HTTP payload parsing

Maintainers

hueniversejohnbrettmarsupnlfwyatt

Keywords

httppayloadfilestreammultipart

Dependencies (5)

PackageConstraintRegistry Status
pez 4.x.x rejected
boom 7.x.x auto_approved
hoek 6.x.x No greenflagged match
wreck 14.x.x auto_approved
content 4.x.x rejected

Dev Dependencies (3)

PackageConstraintRegistry Status
lab 17.x.x auto_approved
code 5.x.x auto_approved
form-data 2.1.x No greenflagged match

Transitive Dependency Tree

6 transitive deps max depth 3
  ├─ boom 7.x.x → 7.3.0
  ├─ content 4.x.x → 4.0.5
  ├─ hoek 6.x.x
  ├─ pez 4.x.x → 4.0.4
├─ wreck 14.x.x → 14.2.0
  ├─ boom 7.x.x → 7.3.0
  ├─ bourne 1.x.x → 1.3.3
├─ hoek 6.x.x → 6.1.2
  ├─ hoek 6.x.x → 6.1.2

Changes from v4.4.1

Dependency Changes

ChangePackageVersion
changed pez 2.x.x → 4.x.x
changed boom 5.x.x → 7.x.x
changed hoek 4.x.x → 6.x.x
changed wreck 12.x.x → 14.x.x
changed content 3.x.x → 4.x.x

File Changes

0 added 0 removed 4 modified size delta: -2.4 KB

Risk Dispositions (1 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule Source Disposition Author Reason
osv:GHSA-2mvq-xp48-4c77 osv reject AI AI (osv): Advisory covers all versions of subtext with no fix available; the package is abandoned in favor of @hapi/subtext. Verdict generalizes to every published version of this package.

SAST Findings (2)

CRITICAL GHSA-2mvq-xp48-4c77: Denial of Service in subtext osv

[Always reject] All versions of `subtext` are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service. ## Recommendation This package is not actively maintained and has been moved to `@hapi/subtext` where version 6.1.2.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Review Summary

Risk score: 43. Findings: 1 critical (+40), 1 low (+3).

Commit: 96ad4b664791 Browse source

Published to npm: