In our company we use veracode to scan our code and this tool give us a summary report at the end with the vulnerabilities found on our source code or dependencies.
I have created a new SPFx webpart, empty! just the basic hello world, and even then the tool found one vulnerability.
Regular Expression Denial Of Service (ReDoS): validator is vulnerable to regular expression denial of service (ReDoS) attacks. A malicious user can pass a long URI to the
isDataURI() function to cause a ReDoS attack.
When checking the dependency tree I found this:
├─┬ @firstname.lastname@example.org │ └─┬ @email@example.com │ └─┬ firstname.lastname@example.org │ └── email@example.com └─┬ @firstname.lastname@example.org └─┬ email@example.com └── firstname.lastname@example.org
If I understand correctly, I cant upgrade it myself because it may break the sp-module-interfaces.
Is there something I can do to update this package?