npm Audit

Hello, 
i have check the npm in the docker container from image: evershop/evershop:2.1.1

first of all, thank you for the great work on EverShop. I really like the modern architecture, PostgreSQL support, Docker integration and the overall developer experience.

While testing the current version, I noticed that npm audit reports a relatively high number of vulnerabilities in dependencies, including several high severity issues and at least one critical advisory (for example in Handlebars, Axios, lodash and multer).

I understand that many of these are transitive dependencies and not necessarily direct application vulnerabilities. However, from a security and production perspective, this may make some users hesitant to deploy EverShop publicly.

It would be great if dependency updates and security hardening could receive additional focus in future releases. EverShop has a lot of potential and improving the overall security posture would significantly increase confidence for production use.

Thank you again for your work and for building such an interesting modern commerce platform.

I will definitely continue to follow the project and future releases with great interest, because I really like the overall concept and modern technical approach.

docker exec -it evershop npm audit
50 vulnerabilities (1 low, 38 moderate, 10 high, 1 critical)

# npm audit report

ajv  7.0.0-alpha.0 - 8.17.1
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix`
node_modules/ajv

axios  1.0.0 - 1.15.1
Severity: high
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF - https://github.com/advisories/GHSA-3p68-rc4w-qgx5
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain - https://github.com/advisories/GHSA-fvcv-3m26-pcqx
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy - https://github.com/advisories/GHSA-w9j2-pvgh-6h63
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 - https://github.com/advisories/GHSA-pmwg-cvhr-8vh7
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` - https://github.com/advisories/GHSA-3w6x-2g7m-8v23
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - https://github.com/advisories/GHSA-q8qp-cvcw-x6jj
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams - https://github.com/advisories/GHSA-xhjh-pmcv-23jw
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream - https://github.com/advisories/GHSA-445q-vr5w-6q77
Axios: no_proxy bypass via IP alias allows SSRF - https://github.com/advisories/GHSA-m7pr-hjqh-92cm
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data - https://github.com/advisories/GHSA-62hf-57xw-28j9
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 - https://github.com/advisories/GHSA-5c9x-8gcm-mpgx
Axios: HTTP adapter streamed responses bypass maxContentLength - https://github.com/advisories/GHSA-vf2m-468p-8v99
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking - https://github.com/advisories/GHSA-pf86-5x62-jrwf
Axios: Header Injection via Prototype Pollution - https://github.com/advisories/GHSA-6chq-wfr3-2hj9
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion - https://github.com/advisories/GHSA-xx6v-rp6x-q39c
fix available via `npm audit fix`
node_modules/axios

bn.js  <4.12.3
Severity: moderate
bn.js affected by an infinite loop - https://github.com/advisories/GHSA-378v-28hj-76wf
fix available via `npm audit fix`
node_modules/bn.js

brace-expansion  2.0.0 - 2.0.2
Severity: moderate
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
fix available via `npm audit fix`
node_modules/brace-expansion

ckeditor5  >=29.0.0 <47.6.0
Severity: moderate
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - https://github.com/advisories/GHSA-jrqm-vmqc-gm93
No fix available
node_modules/ckeditor5
  @ckeditor/ckeditor5-adapter-ckfinder  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-adapter-ckfinder
  @ckeditor/ckeditor5-autoformat  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-autoformat
  @ckeditor/ckeditor5-basic-styles  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-basic-styles
  @ckeditor/ckeditor5-block-quote  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-block-quote
  @ckeditor/ckeditor5-ckbox  <=47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-ckbox
    @ckeditor/ckeditor5-build-classic  >=29.0.0
    Depends on vulnerable versions of @ckeditor/ckeditor5-adapter-ckfinder
    Depends on vulnerable versions of @ckeditor/ckeditor5-autoformat
    Depends on vulnerable versions of @ckeditor/ckeditor5-basic-styles
    Depends on vulnerable versions of @ckeditor/ckeditor5-block-quote
    Depends on vulnerable versions of @ckeditor/ckeditor5-ckbox
    Depends on vulnerable versions of @ckeditor/ckeditor5-ckfinder
    Depends on vulnerable versions of @ckeditor/ckeditor5-cloud-services
    Depends on vulnerable versions of @ckeditor/ckeditor5-easy-image
    Depends on vulnerable versions of @ckeditor/ckeditor5-editor-classic
    Depends on vulnerable versions of @ckeditor/ckeditor5-essentials
    Depends on vulnerable versions of @ckeditor/ckeditor5-heading
    Depends on vulnerable versions of @ckeditor/ckeditor5-image
    Depends on vulnerable versions of @ckeditor/ckeditor5-indent
    Depends on vulnerable versions of @ckeditor/ckeditor5-link
    Depends on vulnerable versions of @ckeditor/ckeditor5-list
    Depends on vulnerable versions of @ckeditor/ckeditor5-media-embed
    Depends on vulnerable versions of @ckeditor/ckeditor5-paste-from-office
    Depends on vulnerable versions of @ckeditor/ckeditor5-table
    node_modules/@ckeditor/ckeditor5-build-classic
      @evershop/evershop  *
      Depends on vulnerable versions of @ckeditor/ckeditor5-build-classic
      Depends on vulnerable versions of @swc/cli
      node_modules/@evershop/evershop
  @ckeditor/ckeditor5-ckfinder  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-ckfinder
  @ckeditor/ckeditor5-cloud-services  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-cloud-services
  @ckeditor/ckeditor5-easy-image  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-easy-image
  @ckeditor/ckeditor5-editor-classic  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-editor-classic
  @ckeditor/ckeditor5-essentials  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-essentials
  @ckeditor/ckeditor5-heading  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-heading
  @ckeditor/ckeditor5-image  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-image
  @ckeditor/ckeditor5-indent  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-indent
  @ckeditor/ckeditor5-link  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-link
  @ckeditor/ckeditor5-list  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-list
  @ckeditor/ckeditor5-media-embed  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-media-embed
  @ckeditor/ckeditor5-paste-from-office  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-paste-from-office
  @ckeditor/ckeditor5-table  29.0.0 - 47.6.0-alpha.9
  Depends on vulnerable versions of ckeditor5
  node_modules/@ckeditor/ckeditor5-table

file-type  13.0.0 - 21.3.1
Severity: moderate
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header - https://github.com/advisories/GHSA-5v7r-6r5c-r473
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry - https://github.com/advisories/GHSA-j47w-4g3g-c36v
No fix available
node_modules/file-type
  @xhmikosr/archive-type  6.0.0 - 7.1.0
  Depends on vulnerable versions of file-type
  node_modules/@xhmikosr/archive-type
    @xhmikosr/downloader  10.0.0 - 10.0.1 || 12.0.0 - 15.2.0
    Depends on vulnerable versions of @xhmikosr/archive-type
    Depends on vulnerable versions of @xhmikosr/decompress
    Depends on vulnerable versions of file-type
    node_modules/@xhmikosr/downloader
      @xhmikosr/bin-wrapper  10.0.0 - 13.2.0
      Depends on vulnerable versions of @xhmikosr/downloader
      node_modules/@xhmikosr/bin-wrapper
        @swc/cli  0.5.1 - 0.8.0
        Depends on vulnerable versions of @xhmikosr/bin-wrapper
        node_modules/@swc/cli
  @xhmikosr/decompress-tar  6.0.0 - 8.1.0
  Depends on vulnerable versions of file-type
  node_modules/@xhmikosr/decompress-tar
    @xhmikosr/decompress-tarbz2  6.0.0 - 9.0.0
    Depends on vulnerable versions of @xhmikosr/decompress-tar
    Depends on vulnerable versions of file-type
    node_modules/@xhmikosr/decompress-tarbz2
      @xhmikosr/decompress  8.0.0 - 10.2.0
      Depends on vulnerable versions of @xhmikosr/decompress-tar
      Depends on vulnerable versions of @xhmikosr/decompress-tarbz2
      Depends on vulnerable versions of @xhmikosr/decompress-targz
      Depends on vulnerable versions of @xhmikosr/decompress-unzip
      node_modules/@xhmikosr/decompress
    @xhmikosr/decompress-targz  6.0.0 - 9.0.0
    Depends on vulnerable versions of @xhmikosr/decompress-tar
    Depends on vulnerable versions of file-type
    node_modules/@xhmikosr/decompress-targz
  @xhmikosr/decompress-unzip  6.0.0 - 7.1.0
  Depends on vulnerable versions of file-type
  node_modules/@xhmikosr/decompress-unzip

follow-redirects  <=1.15.11
Severity: moderate
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets - https://github.com/advisories/GHSA-r4q5-vmmm-2653
fix available via `npm audit fix`
node_modules/follow-redirects

handlebars  4.0.0 - 4.7.8
Severity: critical
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block - https://github.com/advisories/GHSA-3mfm-83xf-c92r
Handlebars.js has JavaScript Injection via AST Type Confusion - https://github.com/advisories/GHSA-2w6w-674q-4c4q
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection - https://github.com/advisories/GHSA-2qvq-rjwj-gvw9
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry - https://github.com/advisories/GHSA-7rx3-28cr-v5wh
Handlebars.js has a Property Access Validation Bypass in container.lookup - https://github.com/advisories/GHSA-442j-39wm-28r2
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial - https://github.com/advisories/GHSA-xhpv-hc6g-r9c6
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation - https://github.com/advisories/GHSA-9cx6-37pm-9jff
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options - https://github.com/advisories/GHSA-xjpj-3mr7-gcpf
fix available via `npm audit fix`
node_modules/handlebars

immutable  5.0.0 - 5.1.4
Severity: high
Immutable is vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-wf6x-7x77-mvgw
fix available via `npm audit fix`
node_modules/immutable

lodash  <=4.17.23
Severity: high
lodash vulnerable to Code Injection via `_.template` imports key names - https://github.com/advisories/GHSA-r5fr-rjxr-66jc
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - https://github.com/advisories/GHSA-f23m-r3pf-42rh
fix available via `npm audit fix`
node_modules/lodash

lodash-es  <=4.17.23
Severity: high
lodash vulnerable to Code Injection via `_.template` imports key names - https://github.com/advisories/GHSA-r5fr-rjxr-66jc
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - https://github.com/advisories/GHSA-f23m-r3pf-42rh
fix available via `npm audit fix`
node_modules/lodash-es

minimatch  9.0.0 - 9.0.6 || 10.0.0 - 10.2.2
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/@swc/cli/node_modules/minimatch
node_modules/minimatch

multer  <=2.1.0
Severity: high
Multer vulnerable to Denial of Service via incomplete cleanup - https://github.com/advisories/GHSA-xf7r-hgr6-v32p
Multer vulnerable to Denial of Service via resource exhaustion - https://github.com/advisories/GHSA-v52c-386h-88mc
Multer Vulnerable to Denial of Service via Uncontrolled Recursion - https://github.com/advisories/GHSA-5528-5vmv-3xc2
fix available via `npm audit fix`
node_modules/multer

path-to-regexp  <0.1.13
Severity: high
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - https://github.com/advisories/GHSA-37ch-88jc-xwx2
fix available via `npm audit fix`
node_modules/path-to-regexp

picomatch  <=2.3.1 || 4.0.0 - 4.0.3
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
fix available via `npm audit fix`
node_modules/@parcel/watcher/node_modules/picomatch
node_modules/picomatch
node_modules/tinyglobby/node_modules/picomatch

postcss  <8.5.10
Severity: moderate
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93
fix available via `npm audit fix`
node_modules/postcss

qs  6.7.0 - 6.14.1
qs's arrayLimit bypass in comma parsing allows denial of service - https://github.com/advisories/GHSA-w7fw-mjwx-w883
fix available via `npm audit fix`
node_modules/qs

serialize-javascript  <=7.0.4
Severity: high
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - https://github.com/advisories/GHSA-5c6j-r48x-rmvq
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - https://github.com/advisories/GHSA-qj8w-gfj5-8c6v
fix available via `npm audit fix`
node_modules/serialize-javascript
  terser-webpack-plugin  <=5.3.16
  Depends on vulnerable versions of serialize-javascript
  node_modules/terser-webpack-plugin

yaml  1.0.0 - 1.10.2
Severity: moderate
yaml is vulnerable to Stack Overflow via deeply nested YAML collections - https://github.com/advisories/GHSA-48c2-rrv3-qjmp
fix available via `npm audit fix`
node_modules/yaml

yauzl  3.2.0
Severity: moderate
yauzl contains an off-by-one error - https://github.com/advisories/GHSA-gmq8-994r-jv83
fix available via `npm audit fix`
node_modules/yauzl

50 vulnerabilities (1 low, 38 moderate, 10 high, 1 critical)

To address issues that do not require attention, run:
  npm audit fix

Some issues need review, and may require choosing
a different dependency.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

npm Audit #937

npm audit report

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

npm Audit #937

Description

npm audit report

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions