Homepage
About Snyk

helmet-csp@2.7.1 vulnerabilities

Content Security Policy middleware

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the helmet-csp package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Configuration Override

helmet-csp is a Content Security Policy that helps prevent unwanted content being injected into your webpages.

Affected versions of this package are vulnerable to Configuration Override affecting the application's Content Security Policy (CSP). It's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP.

How to fix Configuration Override?

Upgrade helmet-csp to version 2.9.2 or higher.

>=1.2.2 <2.9.2
Go back to all versions of this package