Homepage

helmet-csp@2.7.1 vulnerabilities

Content Security Policy middleware

  • latest version

    4.0.0

  • latest non vulnerable version

    4.0.0

  • first published

    10 years ago

  • latest version published

    7 months ago

  • licenses detected

  • View helmet-csp package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the helmet-csp package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Configuration Override

    helmet-csp is a Content Security Policy that helps prevent unwanted content being injected into your webpages.

    Affected versions of this package are vulnerable to Configuration Override affecting the application's Content Security Policy (CSP). It's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP.

    How to fix Configuration Override?

    Upgrade helmet-csp to version 2.9.2 or higher.

    >=1.2.2 <2.9.2
    Go back to all versions of this package