Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Address npm audit vulnerabilities (nodemailer, multer, express deps)

Abierto
  • ¿Algo no está bien?
#1,118 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 7 días

@gangster ya está trabajando en esto.

Desde el 15/10/2026.

  • #1119 de @gangster — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Refactorización
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
express, javascript, mysql, nodejs, sqlite
Área
backend, build-system, security

Línea de trabajo

Start with app/package.json and run npm audit to see which advisories remain. The payload names app/uploader.js (multer limits) and app/emailer.js with app/endpoints/manage_event.js (nodemailer use) as the code that changes, and the sqlite3 and hugo-installer install paths are separate. Done means the audit count drops, the test suite passes, and image upload and the confirmation email work locally. Major-version bumps (nodemailer, sqlite3, faker) need changelog review, so expect to ask maintainers before merging.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

npm audit reports 34 vulnerabilities (4 critical, 24 high, 4 moderate, 2 low).
Most are in dev, build, or install-time dependencies, but a few affect the production backend.

Production exposure

  • nodemailer ~7.0.11: the event confirmation email (app/endpoints/manage_event.js) sends to a user-supplied name and address, which is the input targeted by the addressparser DoS and recipient-domain bypass advisories.
    Fixed in 10.x (major).
  • multer ~2.1.1: the public image upload endpoint is exposed to several DoS advisories via crafted field names.
    app/uploader.js limits file count and size, but not fields, parts, or fieldNameSize.
    Fixed in 2.4.0.
  • qs / body-parser / express: query string DoS, reachable on every request.
    Fixed by npm audit fix.
  • proxy-addr (critical): low impact here since we set trust proxy to true and don't read req.ip.
    Fixed by npm audit fix.
  • mysql2 ~3.14.0: requires a malicious or impersonated database server.
    Fixed in 3.24.6.
  • lodash ~4.17.21: we only use pickBy, so not affected, but cheap to bump to 4.18.1.

Install, dev, and build only

  • tar / node-gyp / cacache (critical) via sqlite3@5, used at install time only; production uses MySQL.
    Fixed in sqlite3 6.x (major).
  • decompress / semver (critical) via hugo-installer, which extracts the Hugo release archive during postinstall.
    npm audit fix updates decompress; ignore the --force suggestion, which downgrades hugo-installer.
  • @faker-js/faker in tools/; helpers.fake isn't used.
    Fixed in 10.x (major).
  • @vue/server-renderer: cal/ is client-side only.
  • shell-quote, braces, micromatch, brace-expansion, nanoid, source-map-js, http-cache-semantics, ip-address: dev and build tooling only.

Proposed fix

  1. Run npm audit fix (non-breaking).
  2. Bump ranges in app/package.json: multer ~2.4.0, mysql2 ~3.24.6, lodash ~4.18.1.
  3. Upgrade nodemailer to 10.x and check app/emailer.js against the changelog.
  4. Upgrade sqlite3 to 6.x and @faker-js/faker to 10.x.
  5. Add fields, parts, and fieldNameSize limits to the multer config in app/uploader.js.
  6. Run the test suite and verify image upload and the confirmation email locally.
Lenguaje dominante
JavaScript
Estrellas
30
Forks
26
Merge medio
6 d 24 min
PR fusionados (30 d)
6

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de shift-org/shift-docs

Todos los issues de shift-org/shift-docs

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.