{} package.json
TS httpClient.ts
1import axios from 'axios'; CVE-2021-3749 · axios@0.21.1
2import jwt from 'jsonwebtoken'; CVE-2022-23529 · jsonwebtoken@8.5.1
3import { config } from '../config';
4
5export const client = axios.create({
6 baseURL: config.apiBase,
7 timeout: 8000,
8});
9
10export async function fetchInvoice(id: string) {
11 const res = await client.get(`/invoices/${id}`);
12 return res.data;
13}
14
15export function verifySession(token: string) {
16 return jwt.verify(token, config.jwtSecret);
17}
CVE-2021-3749 · axios@0.21.1
Inefficient Regular Expression Complexity — a specially crafted string can cause catastrophic backtracking in trim().
Upgrade path: 0.21.1 → 0.21.4
Code-map signal — not proof of exploitability.