Regular Expression Denial of Service

[kaleb-kougl4]

normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

[Grace-Dmello]

Facing the same issue. High-risk vulnerabilities.

css-what >=5.0.1
immer >=8.0.1

[cricketnest]

Facing the same issue.

[croraf]

Can this be cosed in favor of: #11012 ?

[gaearon]

These warnings are false positives. There are no actual vulnerabilities affecting your app here.

To fix npm audit warnings, move react-scripts from dependencies to devDependencies in your package.json.

That will remove the false positive warnings.

I agree with the point in #11102 and will make this change so that new projects don't keep having these false positive warnings.

If you want to discuss this, please comment in #11102.

[gaearon]

Please see #11174.