Vulnerability in @worker-tools/stripe-webhook: constructEvent does not verify header
Summary
GHSA-4g53-vp7q-gfjv: constructEvent does not verify header. Affects @worker-tools/stripe-webhook versions < 1.1.4. Fixed in 1.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @worker-tools/stripe-webhook package is an npm package that provides functionality for verifying Stripe webhook requests. It includes a function called constructEvent which is used to verify the header of a webhook request. However, prior to version 1.1.4, this function does not properly verify the header, making it susceptible to potential security vulnerabilities.
Vulnerability Detail
The vulnerability in @worker-tools/stripe-webhook arises from the lack of header verification in the constructEvent function. This means that anyone verifying a Stripe webhook request using this function may be vulnerable to potential attacks. The impact of this vulnerability can vary depending on the specific use case, but it has the potential to compromise the security and integrity of the webhook verification process. It is important to note that this vulnerability has been acknowledged and addressed by the package maintainers, and a patch has been released in version 1.1.4.
How To Fix
Latest published version: 1.1.4 as of 22 Oct 2026
npm install @worker-tools/stripe-webhook@1.1.4The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.1.4 is not immediately feasible, a workaround is to use the await verifyHeader(...) function directly instead of relying on the constructEvent function. This will bypass the vulnerable code and provide a temporary solution until the package can be updated.
Conclusion
In conclusion, the @worker-tools/stripe-webhook package prior to version 1.1.4 is vulnerable to a security issue where the constructEvent function does not properly verify the header of a webhook request. This vulnerability can potentially compromise the security and integrity of the webhook verification process. It is recommended to upgrade to version 1.1.4 or use the provided workaround until the package can be updated. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @worker-tools/stripe-webhook →
FAQ
The impact of this vulnerability can vary depending on the specific use case, but it has the potential to compromise the security and integrity of the webhook verification process.
To fix this vulnerability, it is recommended to upgrade to version 1.1.4 of the @worker-tools/stripe-webhook package.
Yes, a workaround is to use the await verifyHeader(...) function directly instead of relying on the constructEvent function.
Yes, the vulnerability has been acknowledged and addressed by the package maintainers. A patch has been released in version 1.1.4.
More information about this vulnerability can be found in the GitHub advisory: [link to GitHub advisory]
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
