{"id":"GHSA-4g53-vp7q-gfjv","aliases":[],"status":"published","title":"constructEvent does not verify header","description":"### Impact\nAnyone verifying a Stripe webhook request via this library's `constructEvent` function.\n\n### Patches\nUpgrade to 1.1.4. \n\n### Workarounds\nUse `await verifyHeader(...)` directly instead of `constructEvent`.\n\n### References\nhttps://github.com/worker-tools/stripe-webhook/issues/1","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-05-28T19:18:28Z","modified":"2023-01-09T05:04:42Z","fixes":[{"ecosystem":"npm","package":"@worker-tools/stripe-webhook","fixed_in":["1.1.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@worker-tools/stripe-webhook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4"}]}]},{"source":"osv","ecosystem":"npm","package":"@worker-tools/stripe-webhook","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.4"}]}]}],"references":[{"url":"https://github.com/worker-tools/stripe-webhook/security/advisories/GHSA-4g53-vp7q-gfjv","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4g53-vp7q-gfjv"}],"sources":{"ghsa":[{"id":"GHSA-4g53-vp7q-gfjv","title":"constructEvent does not verify header","description":"### Impact\nAnyone verifying a Stripe webhook request via this library's `constructEvent` function.\n\n### Patches\nUpgrade to 1.1.4. \n\n### Workarounds\nUse `await verifyHeader(...)` directly instead of `constructEvent`.\n\n### References\nhttps://github.com/worker-tools/stripe-webhook/issues/1\n","status":"published","published":"2021-05-28T19:18:28Z","modified":"2023-01-09T05:04:42Z","updated_at":"2026-11-02T14:36:10.502376Z"}],"osv":[{"id":"GHSA-4g53-vp7q-gfjv","title":"constructEvent does not verify header","description":"### Impact\nAnyone verifying a Stripe webhook request via this library's `constructEvent` function.\n\n### Patches\nUpgrade to 1.1.4. \n\n### Workarounds\nUse `await verifyHeader(...)` directly instead of `constructEvent`.\n\n### References\nhttps://github.com/worker-tools/stripe-webhook/issues/1\n","status":"published","published":"2021-05-28T19:18:28Z","modified":"2021-05-27T22:24:49Z","updated_at":"2026-11-02T15:46:36.782754Z"}]}}