Security vulnerabilities and automated fixes for npm issues
17 posts found
A critical parsing inconsistency in the `ip-address` npm package (version 10.2.0) allowed attackers to bypass SSRF protections by exploiting how leading-zero octets are interpreted differently—decimal by the library versus octal by system resolvers. This vulnerability (CVE-2026-69192) was fixed by upgrading to version 10.3.1 using an npm override, ensuring consistent IP address validation across the application.
A high-severity vulnerability in the nanoid package (CVE-2026-67213) allowed attackers to trigger infinite loops through the customAlphabet function, potentially causing complete denial of service. This fix upgrades nanoid from version 3.3.16 to 3.3.17 in the app_store dependency tree, eliminating the DoS risk through a simple version override.
A high-severity Denial of Service vulnerability (CVE-2026-5079) was discovered in the multer package, a popular Node.js middleware for handling multipart form data. Attackers could craft malicious requests with deeply nested field names to exhaust server resources. The fix upgrades multer from version 2.0.2 to 2.2.0, which implements proper limits on field name parsing depth.
A high-severity infinite loop vulnerability (CVE-2026-67213) was discovered in the nanoid package's `customAlphabet` function, affecting versions before 5.1.6. The concord-frontend application depended on nanoid 6.0.1, which contained this flaw. The fix downgrades to nanoid 3.3.17, a patched version that eliminates the infinite loop condition triggered by crafted input to custom alphabet ID generation.
A high-severity vulnerability in Nodemailer (versions before 9.0.0) allowed the `raw` message option to completely bypass `disableFileAccess` and `disableUrlAccess` security controls, enabling attackers to read arbitrary files from the server filesystem and perform full-response Server-Side Request Forgery (SSRF) in delivered email messages. Upgrading from `^8.0.10` to `^9.0.4` in `backend/package-lock.json` closes this exploit primitive by enforcing access restrictions consistently across all m
A high-severity Denial of Service vulnerability (CVE-2026-14257) in the `brace-expansion` package version 1.1.12 allowed attackers to craft malicious brace patterns that caused exponential-time complexity, leading to out-of-memory process crashes. The fix upgrades the dependency to version 1.1.16 using npm overrides to ensure the patched version is used throughout the entire dependency tree.
A high-severity denial of service vulnerability (CVE-2026-14257) was discovered in the brace-expansion package within the zeroshot-oecp Docker container's dependency tree. The vulnerability allows attackers to craft malicious input patterns that trigger exponential-time processing, potentially freezing or crashing Node.js applications. This fix upgrades the nested brace-expansion dependency to version 5.0.9 using a targeted Dockerfile modification.
A high-severity Denial of Service vulnerability (CVE-2026-13149) was discovered in the brace-expansion npm package, where specially crafted input patterns could trigger exponential time complexity, potentially freezing Node.js applications. The fix upgrades multiple versions of brace-expansion (1.1.18 → 1.1.16, 2.1.1 → 2.1.2, and 5.0.6 → 5.0.7) through yarn resolutions to ensure all dependency paths use patched versions.
A high-severity denial of service vulnerability (CVE-2026-59892) was discovered in the @opentelemetry/propagator-jaeger package, where malformed HTTP headers could crash Node.js applications. The fix involved upgrading from version 2.8.0 to 2.9.0, which includes proper input validation for Jaeger trace context headers.
A high-severity vulnerability in Nodemailer versions prior to 9.0.1 allowed attackers to bypass the `disableFileAccess` and `disableUrlAccess` security controls using the message-level `raw` option. This bypass enabled arbitrary file reads from the server and full-response Server-Side Request Forgery (SSRF) attacks, potentially exposing sensitive configuration files and internal network resources. The fix involves upgrading Nodemailer from version 8.0.7 to 9.0.1.
A high-severity vulnerability was discovered in a Node.js library's `.github/dependabot.yml` configuration file where no cooldown period was set for package updates. This exposed the project to potentially malicious or unstable newly-published packages, as Dependabot would immediately propose updates without any waiting period. The fix adds a 7-day cooldown to the npm package-ecosystem configuration, ensuring a safety window before adopting new package versions.
A high-severity Denial of Service vulnerability (CVE-2026-39244) was discovered in adm-zip versions prior to 0.6.0, affecting the laliga-fantasy-app. Attackers could craft malicious ZIP files that trigger excessive memory allocation, potentially crashing the web service. The fix involved upgrading adm-zip from version 0.5.16 to 0.6.0, which includes proper memory allocation bounds checking.