NSP vulnerability for protobufjs <=6.8.5

[mboughaba]

[REQUIRED] Describe your environment

• Firebase SDK version: 5.0.4
• Firebase Product: firestore

[REQUIRED] Describe the problem

Steps to reproduce:

nsp check

I am referencing #813. It looks like this is still an issue.
protobufjs@5.0.3 seems vulnerable too.

λ nsp check --reporter table
(+) 1 vulnerability found
┌────────────┬────────────────────────────────────────────────────────────────────┐
│            │ Denial of Service                                                  │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Name       │ protobufjs                                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ CVSS       │ 5 (Medium)                                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Installed  │ 5.0.3                                                              │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Vulnerable │ <=6.8.5                                                            │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Patched    │ >=6.8.6                                                            │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Path       │ alita-web@0.1.2 > firebase@5.0.4 > @firebase/firestore@0.5.4 >     │
│            │ grpc@1.11.3 > protobufjs@5.0.3                                     │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ More Info  │ https://nodesecurity.io/advisories/605                             │
└────────────┴────────────────────────────────────────────────────────────────────┘

Cheers

[omar10594]

The fix was ported to 5.x.x version, 5.0.3 has the fix.
But nodesecurity still have outdated information on the status of this problem.
After update to 5.0.3 you can ignore the vulnerability until nodesecurity update their database.

see protobufjs/protobuf.js/pull/1030

[mboughaba]

nsp database has been updated and indeed fix was ported to 5.0.3.