| Package | Affected versions | Patched versions |
|---|---|---|
| twitter-stream | ≤ 0.1.16 | |
| twitter-stream | = 0.1.10 |
In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free