Security vulnerabilities and automated fixes for bun issues
2 posts found
A high-severity vulnerability in the `ip-address` npm package (CVE-2026-69192) allowed attackers to craft IPv4 addresses with leading-zero octets that the library decoded as decimal while system resolvers decoded them as octal — creating a dangerous parsing discrepancy that could enable Server-Side Request Forgery (SSRF) and trust-boundary bypass. The fix upgrades `ip-address` from version 10.1.0 to 10.3.1 in the `core/http/react-ui` frontend dependency tree, eliminating the inconsistency and en
CVE-2026-67213 is a high-severity Denial of Service vulnerability in the popular nanoid package, where a flaw in the custom alphabet ID generation logic could trigger an infinite loop, hanging the process indefinitely. The fix upgrades nanoid from 3.3.16 to 3.3.18 (and pins the 5.x branch to 5.1.6), patching the loop condition so that all valid alphabet inputs terminate correctly. Any Node.js or Bun application using nanoid's `customAlphabet` function with user-influenced input is potentially af