Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP, possibly rendering the application vulnerable to Cross-Site Scripting.

Recommendation

Upgrade to version 2.9.1 or later. Setting the browserSniff configuration to false in vulnerable versions also mitigates the issue.

References

• https://www.npmjs.com/advisories/1176
• helmetjs/csp@67a69ba
• https://snyk.io/vuln/SNYK-JS-HELMETCSP-469436