Security vulnerability in (virtually unused) stringstream dependency

[benwiggins]

Summary

request 2.85.0 has a direct dependency on stringstream 0.0.5, which has a security vulnerability which leaks uninitialised memory.

https://snyk.io/vuln/npm:stringstream:20180511
https://hackerone.com/reports/321670

Expected Behavior

No vulnerability

Current Behavior

A vulnerable version of stringstream is installed and referenced in the request module.

(Admittedly it is unlikely it actually executes on any supported version of Node.js)

Possible Solution

stringstream is only necessary for very old versions of Node.js that are no longer supported (<0.9.4).

Pull request #2885 already exists to remove stringstream.

[simov]

#2885 was merged

[ChALkeR]

@simov 2.86.x wasn't published on npm yet, and latest version published on npm still causes warnings.

[simov]

I've published it: https://snyk.io/test/npm/request

[ChALkeR]

@simov Thanks!

[mattgrande]

Including just for searchability, this was also reported in NSP: https://nodesecurity.io/advisories/664