fast-xml-parser dependency has a vulnerability

[Jish2]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

$ yarn audit --groups dependencies
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ fast-xml-parser vulnerable to ReDOS at currency parsing      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ fast-xml-parser                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.4.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @aws-sdk/client-lambda                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @aws-sdk/client-lambda > @aws-sdk/core > fast-xml-parser     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1098305                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

SDK version number

@aws-sdk/[email protected]

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

all

Reproduction Steps

Run npm audit

Observed Behavior

vulnerability present

Expected Behavior

no vulnerability present

Possible Solution

bump fast-xml-parser to patched version 4.4.1

Additional Information/Context

https://www.npmjs.com/advisories/1098305

[knixeur]

Fixed ( or will be 😄 ) by #6326

[trivikr]

The new version https://github.com/aws/aws-sdk-js-v3/releases/tag/v3.621.0 with updated version of fast-xml-parser is expected to release around 12:30 PM Pacific today (Tue, July 30th)

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.