0

I use the trivy GitHub action (aquasecurity/trivy-action@master) to scan my nestjs project, but keep getting the below vulnerabilities even though I have not used those packages directly and indirectly (no trace of them in my yarn.lock). why would trivy report these vulnerabilities?

┌─────────────────────────────────────┬────────────────┬──────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│               Library               │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                           Title                            │
├─────────────────────────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ dot-object (package.json)           │ CVE-2019-10793 │ MEDIUM   │ 1.1.0             │ 2.1.3         │ Prototype Pollution in dot-object                          │
│                                     │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2019-10793                 │
├─────────────────────────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ http-cache-semantics (package.json) │ CVE-2022-25881 │ HIGH     │ 4.1.0             │ 4.1.1         │ http-cache-semantics: Regular Expression Denial of Service │
│                                     │                │          │                   │               │ (ReDoS) vulnerability                                      │
│                                     │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-25881                 │
└─────────────────────────────────────┴────────────────┴──────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘
Azeem
  • 11,148
  • 4
  • 27
  • 40
Peter_101
  • 303
  • 4
  • 13
  • try use the `npm why ` command, https://stackoverflow.com/a/54599863/2270041 – Matteo Mar 20 '23 at 08:30
  • PS C:\repo\todo-js> yarn why http-cache-semantics yarn why v1.22.17 [1/4] Why do we have the module "http-cache-semantics"...? [2/4] Initialising dependency graph... [3/4] Finding dependency... error We couldn't find a match! – Peter_101 Mar 20 '23 at 09:47

0 Answers0