{"id":"GHSA-4g53-vp7q-gfjv","summary":"constructEvent does not verify header","details":"### Impact\nAnyone verifying a Stripe webhook request via this library's `constructEvent` function.\n\n### Patches\nUpgrade to 1.1.4. \n\n### Workarounds\nUse `await verifyHeader(...)` directly instead of `constructEvent`.\n\n### References\nhttps://github.com/worker-tools/stripe-webhook/issues/1\n","modified":"2021-05-27T22:24:49Z","published":"2021-05-28T19:18:28Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-05-27T22:24:49Z","nvd_published_at":null,"cwe_ids":[]},"references":[{"type":"WEB","url":"https://github.com/worker-tools/stripe-webhook/security/advisories/GHSA-4g53-vp7q-gfjv"}],"affected":[{"package":{"name":"@worker-tools/stripe-webhook","ecosystem":"npm","purl":"pkg:npm/%40worker-tools/stripe-webhook"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-4g53-vp7q-gfjv/GHSA-4g53-vp7q-gfjv.json"}}],"schema_version":"1.9.0"}