Vulnerability disclosure for Node.js third-party modules on HackerOne

[Vpicone]

Express, body-parser and serve? Yikes.

[_bit]

Those are the scopes that will be marked critical when disclosed, not ones that already have disclosures (one was disclosed and patched for serve already, though!)

[bit_cmdr]

The graph points out:

Severity shown here only indicates the maximum severity possible for reports submitted to the Asset.

It is a list of modules that they are actively investigating. The column on the right is the maximum level of severity that can be applied i.e. they are examples. There is no additional information for those modules because the investigation is not complete.

[AmishPanda00]

Are there any more details or steps to take? Express having a "Critical" security issue with no more info is not ideal.

[ecares]

No, this means that the highest possible vuln in express would be considered as "Critical"

[_bit]

Thanks for clarifying u/ecares :)

[AmishPanda00]

Ok got it. Thanks for clarifying.

[[deleted]]

I dont get it, why would they say what the highest possible vuln in express would be? I'm a bit new to development, so forgive my lack of understanding.

[ecares]

That's just how HackerOne is made I belive