Security vulnerabilities and automated fixes for npm issues
67 posts found
A critical command injection vulnerability (CVE-2026-9277) was discovered in the shell-quote npm package, where unescaped line terminators could allow attackers to execute arbitrary code. The fix upgrades shell-quote from version 1.8.2 to 1.9.0 using npm overrides to ensure the patched version is used throughout the dependency tree, closing this dangerous attack vector.
A high-severity Denial of Service vulnerability (CVE-2026-13149) was discovered in the brace-expansion npm package, where maliciously crafted input could trigger exponential-time complexity and crash Node.js applications. The fix upgrades brace-expansion from version 5.0.6 to 5.0.9 using npm overrides to ensure all nested dependencies receive the patched version.
CVE-2026-9277 is a critical command injection vulnerability in the `shell-quote` npm package (versions prior to 1.8.4) caused by unescaped line terminators that allow attackers to inject and execute arbitrary shell commands. The fix pins `shell-quote` to `>=1.8.4` via a `pnpm.overrides` entry, ensuring every transitive consumer in the dependency tree receives the patched version. Any Node.js project that processes user-influenced input through `shell-quote` and has not yet upgraded is at risk of
A Dependabot configuration in `.github/dependabot.yml` was missing a `cooldown` block, meaning dependency update PRs could be opened immediately after a new package version was published — including potentially malicious or compromised packages. Adding a `cooldown: default-days: 7` setting ensures updates are only proposed after a 7-day waiting period, giving the security community time to identify and flag bad packages before they reach your codebase.
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package, where specially crafted brace patterns trigger exponential-time processing that can freeze or crash a Node.js application. The fix upgrades the package from version 1.1.14 to 2.1.2 in the React Native frontend's `package-lock.json`, eliminating the vulnerable code path. Because the affected file is in production code, unpatched applications could be targeted by any attacker able to influence b
Apache Superset's Cypress testing infrastructure depended on `brace-expansion` 5.0.7, a Node.js package vulnerable to denial of service via malformed brace pattern input (CVE-2026-14257). Upgrading to version 5.0.8 in `superset-frontend/cypress-base/package-lock.json` closes the vulnerability. While the affected file is part of the test toolchain, it lives in the production codebase and is flagged by Trivy as likely exploitable.
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package caused by exponential-time complexity when processing certain brace patterns. Because `brace-expansion` is a transitive dependency present in many Node.js projects' production dependency trees, an attacker who can influence glob patterns or file path inputs can trigger runaway CPU consumption and crash the service. The fix upgrades the package to patched versions (1.1.16, 2.1.2, or 5.0.7) and p
CVE-2026-14257 is a high-severity denial-of-service vulnerability in the `brace-expansion` npm package (versions through 5.0.7) that allows an attacker to trigger an out-of-memory process crash by supplying a crafted string with deeply nested or exponentially large brace patterns. The fix upgrades the dependency to version 5.0.8 and pins it via a Yarn resolution to ensure no transitive dependency pulls in the vulnerable version. Left unpatched, this vulnerability could be exploited to take down
CVE-2025-7783 is a critical vulnerability in the `form-data` npm package caused by the use of an unsafe random number generator to produce multipart form boundaries, making those boundaries predictable by an attacker. The fix upgrades `form-data` to versions 2.5.4, 3.0.4, and 4.0.4, which replace the weak random function with a cryptographically secure alternative. This change was applied to the `example-apps/collector/package-lock.json` and `package.json` files in the Instana collector example
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package, where crafted input strings trigger exponential-time processing that can freeze or crash a Node.js application. The fix upgrades `brace-expansion` from `2.0.2` to `2.1.4` and `minimatch` from `5.1.6` to `5.1.9`, along with npm `overrides` to ensure the patched versions are used throughout the entire dependency tree.
CVE-2026-13676 is a high-severity vulnerability in the `fast-uri` npm package where improper handling of Unicode hostnames during URI parsing could allow attackers to bypass security policies. By upgrading `fast-uri` from 3.1.2 to 3.1.3 (or 2.4.2 / 4.0.1 depending on the major version in use), the canonicalization logic is corrected to ensure that Unicode hostnames are normalized consistently before any policy checks are applied. This fix matters because URI parsing libraries are foundational co
CVE-2026-59873 is a critical Denial of Service vulnerability in the `node-tar` npm package (versions before 7.5.19) that allows an attacker to crash or exhaust a Node.js process by supplying a crafted gzip bomb archive. The fix upgrades `tar` from 7.5.16 to 7.5.19 in `frontend/package-lock.json`, closing the decompression resource exhaustion vector without affecting valid archive processing.