Repository navigation
If I have a CVE update what do I do, just wait? #10161
Description
Faling to override the ip-address package which has a CVE problem I decided to be a good citizen and contribute a fix upstream only to find out you do not accept third party contributions on this.
The contributing documents says "We ... will ship security patches for CVEs as they occur." which is good, but I have no visibility into how and when. No issues and no PRS mentions GHSA-rxp7-6hxx-x8q5 (or CVE-2026-111997 (searching for issues on that phrase gives a few matches but that is crappy false positive behaviour on github's part)).
So failing to provide a pull request, the question is what do I do? Just wait and hope for the best?
The fix I would propose was updating make-fetch-happen to vesion 16.0.1 (which also would update supported engine values).
$ npm audit
# npm audit report
ip-address <=10.7.3
Severity: moderate
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process - https://github.com/advisories/GHSA-rxp7-6hxx-x8q5
fix available via `npm audit fix`
node_modules/npm/node_modules/ip-address
...
$ npm ls ip-address
@hlovdal/[email protected] /download/src/egne/hlovdal-node-red-lowercase-in-typescript
└─┬ [email protected]
├─┬ @node-red/[email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected]
└─┬ @node-red/[email protected]
└─┬ @node-red/[email protected]
└─┬ [email protected]
└─┬ [email protected]
└─┬ @npmcli/[email protected]
└─┬ [email protected]
└─┬ [email protected]
└── [email protected]
$
Activity