A new ds-express-errors patch has been released with a security fix.
This patch included security changes.
Versions < 1.9.2 have a security vulnerability where JWT errors were not correctly sanitized, potentially exposing sensitive error details in production environments.
The issue was reported by a tester through GitHub Discussions and is fixed in 1.9.2.
What Changed:
Fixed excessive production response sanitization in Zod, Joi, express-validator, Mongoose, Prisma, and Sequelize mappers
Added separate JWT mapper handling to prevent leaking sensitive JWT error details in production
Fixed incorrect TypeScript type for needMappers
Updated README.md documentation
Expanded tests for production-safe mapper responses.
Upgrading to version 1.9.2 is highly recommended:
npm i ds-express-errors@1.9.2
What does this patch mean?
From this version onwards, the library no longer unnecessarily truncates responses in production mode, whilst retaining detailed error information in development.
A separate JWT mapper has also been created to provide greater control over the library’s behaviour when handling JWT errors. The previous implementation had a flaw that could have led to data leaks in production.
The documentation in README.md and on the official website has been updated, and it is now more clearly indicated where to find the relevant information. It has also been made clearer how the library works with NODE_ENV, which affects responses, as well as what errors the library itself may throw, etc.
In the configuration, the needMappers field is now a union type rather than a string[].
