{"action":"Upgrade passport-saml to 3.1.0 or later.","affected":[{"fixed":"3.1.0","introduced":"0"}],"component":"passport-saml","cve_ids":["CVE-2021-39171"],"ecosystem":"npm","epss":0.01323,"exploited":false,"fixed_versions":["3.1.0"],"ghsa_id":"GHSA-5379-r78w-42h2","id":"tcs_01M5KF2CDG3S9ABY93AQMXA07E","modified_at":"2026-07-08T06:29:28.325301586Z","published_at":"2021-08-30T16:11:57Z","references":["https://osv.dev/vulnerability/GHSA-5379-r78w-42h2","https://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2","https://nvd.nist.gov/vuln/detail/CVE-2021-39171","https://github.com/node-saml/passport-saml/pull/595","https://github.com/node-saml/passport-saml/commit/f1e00b64c21a725f545e675cd810bbaa435a3972","https://github.com/node-saml/passport-saml"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-5379-r78w-42h2","url":"https://osv.dev/vulnerability/GHSA-5379-r78w-42h2"}],"summary":"Unlimited transforms allowed for signed nodes"}