Skip to content

[security] Fix critical security vulnerabilities in dependencies #42

Description

@acald-creator

Security Issue Summary

Our dependency audit revealed 31 vulnerabilities including 1 critical and 10 high-severity issues that need immediate attention.

Critical Vulnerabilities

  • @babel/traverse - Arbitrary code execution when compiling malicious code
  • @rspack/core - DOM Clobbering XSS vulnerability

High-Priority Vulnerabilities

  • body-parser - DoS vulnerability
  • ws - DoS when handling requests with many HTTP headers
  • path-to-regexp - ReDoS vulnerability
  • webpack-dev-middleware - Path traversal vulnerability
  • cross-spawn - ReDoS vulnerability
  • braces - Uncontrolled resource consumption
  • http-proxy-middleware - DoS vulnerability

Immediate Action Required

# Fix critical security issues
bun update @babel/traverse @rspack/core @babel/helpers body-parser ws

# Run audit again to verify fixes
bun audit

Additional Security Updates Needed

  • @babel/runtime - Update to >=7.26.10
  • express - Update to >=4.20.0
  • follow-redirects - Update to >1.15.5
  • micromatch - Update to >=4.0.8
  • serialize-javascript - Update to >=6.0.2

Acceptance Criteria

  • All critical and high vulnerabilities resolved
  • bun audit shows no critical/high security issues
  • All tests pass after security updates
  • Application builds and runs correctly
  • Document any breaking changes or required configuration updates

Priority

P0 - Critical - Should be addressed immediately due to security implications.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions