Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Address npm audit vulnerabilities (nodemailer, multer, express deps)

Aperta
  • Qualcosa non va?
#1,118 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 7 giorni

@gangster ci sta già lavorando.

Dal 15/10/2026.

  • #1119 di @gangster — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Refactoring
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
express, javascript, mysql, nodejs, sqlite
Ambito
backend, build-system, security

Direzione di ricerca

Start with app/package.json and run npm audit to see which advisories remain. The payload names app/uploader.js (multer limits) and app/emailer.js with app/endpoints/manage_event.js (nodemailer use) as the code that changes, and the sqlite3 and hugo-installer install paths are separate. Done means the audit count drops, the test suite passes, and image upload and the confirmation email work locally. Major-version bumps (nodemailer, sqlite3, faker) need changelog review, so expect to ask maintainers before merging.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

npm audit reports 34 vulnerabilities (4 critical, 24 high, 4 moderate, 2 low).
Most are in dev, build, or install-time dependencies, but a few affect the production backend.

Production exposure

  • nodemailer ~7.0.11: the event confirmation email (app/endpoints/manage_event.js) sends to a user-supplied name and address, which is the input targeted by the addressparser DoS and recipient-domain bypass advisories.
    Fixed in 10.x (major).
  • multer ~2.1.1: the public image upload endpoint is exposed to several DoS advisories via crafted field names.
    app/uploader.js limits file count and size, but not fields, parts, or fieldNameSize.
    Fixed in 2.4.0.
  • qs / body-parser / express: query string DoS, reachable on every request.
    Fixed by npm audit fix.
  • proxy-addr (critical): low impact here since we set trust proxy to true and don't read req.ip.
    Fixed by npm audit fix.
  • mysql2 ~3.14.0: requires a malicious or impersonated database server.
    Fixed in 3.24.6.
  • lodash ~4.17.21: we only use pickBy, so not affected, but cheap to bump to 4.18.1.

Install, dev, and build only

  • tar / node-gyp / cacache (critical) via sqlite3@5, used at install time only; production uses MySQL.
    Fixed in sqlite3 6.x (major).
  • decompress / semver (critical) via hugo-installer, which extracts the Hugo release archive during postinstall.
    npm audit fix updates decompress; ignore the --force suggestion, which downgrades hugo-installer.
  • @faker-js/faker in tools/; helpers.fake isn't used.
    Fixed in 10.x (major).
  • @vue/server-renderer: cal/ is client-side only.
  • shell-quote, braces, micromatch, brace-expansion, nanoid, source-map-js, http-cache-semantics, ip-address: dev and build tooling only.

Proposed fix

  1. Run npm audit fix (non-breaking).
  2. Bump ranges in app/package.json: multer ~2.4.0, mysql2 ~3.24.6, lodash ~4.18.1.
  3. Upgrade nodemailer to 10.x and check app/emailer.js against the changelog.
  4. Upgrade sqlite3 to 6.x and @faker-js/faker to 10.x.
  5. Add fields, parts, and fieldNameSize limits to the multer config in app/uploader.js.
  6. Run the test suite and verify image upload and the confirmation email locally.
Lingua principale
JavaScript
Stelle
30
Fork
26
Merge medio
6g 24m
PR unite (30g)
6

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di shift-org/shift-docs

Tutte le issue di shift-org/shift-docs

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.