Security vulnerabilities and automated fixes for dependency management issues
130 posts found
A critical command injection vulnerability (CVE-2026-9277) was discovered in the shell-quote npm package, where unescaped line terminators could allow attackers to execute arbitrary code. The fix upgrades shell-quote from version 1.8.2 to 1.9.0 using npm overrides to ensure the patched version is used throughout the dependency tree, closing this dangerous attack vector.
A high-severity Denial of Service vulnerability (CVE-2026-13149) was discovered in the brace-expansion npm package, where maliciously crafted input could trigger exponential-time complexity and crash Node.js applications. The fix upgrades brace-expansion from version 5.0.6 to 5.0.9 using npm overrides to ensure all nested dependencies receive the patched version.
A high-severity Denial of Service vulnerability in the nanoid package (CVE-2026-67213) was discovered in the project's dependency tree, where crafted input could trigger an infinite loop during random ID generation. The fix upgrades nanoid from 3.3.17 to 3.3.18 and adds an npm override to ensure all transitive dependencies use the patched version.
A Dependabot configuration in `.github/dependabot.yml` was missing cooldown periods for both its npm and GitHub Actions package ecosystems, meaning newly published — potentially malicious or unstable — package versions could be proposed for adoption immediately after release. Adding a `cooldown` block with `default-days: 7` to each ecosystem entry creates a 7-day buffer, allowing the security community time to identify and flag compromised packages before they reach your codebase.
A pnpm workspace configuration had `minimumReleaseAge` set to `0`, meaning newly published npm packages could be installed immediately—before the community has time to detect malicious or compromised releases. By changing this value to `10080` (seven days in minutes), the project now enforces a quarantine window that dramatically reduces exposure to typosquatting, dependency confusion, and post-publish malware injection attacks.
CVE-2026-59873 is a critical Denial of Service vulnerability in the node-tar package, where a specially crafted gzip bomb can exhaust server resources during archive extraction. The fix upgrades tar from version 7.5.16 to 7.5.22 (pinned at `^7.5.19`) in the `@xen-orchestra/backups` package, closing the attack surface against resource exhaustion attacks targeting backup workflows.
A critical Denial of Service vulnerability (CVE-2026-59873) was discovered in node-tar versions prior to 7.5.19, allowing attackers to craft malicious gzip archives that expand to consume excessive memory or CPU, crashing the host process. The fix upgrades the `tar` dependency from 7.5.16 to 7.5.19 in both `package.json` and `package-lock.json`, closing the attack surface for any application that processes user-supplied or remotely fetched archives.
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package, where specially crafted brace patterns trigger exponential-time processing that can freeze or crash a Node.js application. The fix upgrades the package from version 1.1.14 to 2.1.2 in the React Native frontend's `package-lock.json`, eliminating the vulnerable code path. Because the affected file is in production code, unpatched applications could be targeted by any attacker able to influence b
CVE-2026-14257 is a high-severity denial-of-service vulnerability in the `brace-expansion` npm package (versions through 5.0.7) that allows an attacker to trigger an out-of-memory process crash by supplying a crafted string with deeply nested or exponentially large brace patterns. The fix upgrades the dependency to version 5.0.8 and pins it via a Yarn resolution to ensure no transitive dependency pulls in the vulnerable version. Left unpatched, this vulnerability could be exploited to take down
CVE-2026-4867 is a Denial of Service vulnerability in path-to-regexp 0.1.12 where malformed URL parameters can trigger catastrophic backtracking in the library's regular expression engine, allowing an attacker to hang or crash a Node.js application with a single crafted request. The fix upgrades path-to-regexp to version 0.1.13, which patches the vulnerable regex patterns. This change was applied via a package-level override to ensure the patched version is used throughout the entire dependency
A high-severity prototype pollution vulnerability (CVE-2020-8203) was identified in the lodash library via the `zipObjectDeep` function, present as a transitive dependency through postcss in the project's `yarn.lock`. The fix upgrades postcss from 8.5.8 to 8.5.12 using a Yarn resolution override, eliminating the vulnerable lodash code path and reducing the attack surface against crafted CSS input. This change protects the application from object prototype manipulation that could lead to informat
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package, where crafted input strings trigger exponential-time processing that can freeze or crash a Node.js application. The fix upgrades `brace-expansion` from `2.0.2` to `2.1.4` and `minimatch` from `5.1.6` to `5.1.9`, along with npm `overrides` to ensure the patched versions are used throughout the entire dependency tree.