Skip to content

Security Vulnerability Report #466

Description

@slord399

Hi there!
I ran a security scan by dependantbot and noticed quite a few overlapping dependency alerts across the microservices.
Hope those info help you patch issue mentioned.

Critical & Injection Risks

If you only have time to look at a few things, these are the high-impact items that handle direct inputs or risk RCE:

  • SQL / NoSQL Injections

    • @mikro-orm/core(SQL Injection via crafted objects infeed-requests, user-feeds, discord-rest-listener) mongoose(Search injection vulnerability infeed-requests`)
  • Remote Code Execution (RCE) / Logic Bypass:**

    • vitest / @vitest/browser (Arbitrary file read/RCE when UI server listens in backend-api/client)
    • handlebars (JavaScript Injection via AST Type Confusion in backend-api)
    • @fastify/middie (Middleware auth bypass in plugin scopes across multiple services)
  • Bypasses:
    • fast-xml-parser (Entity encoding bypass / DOCTYPE regex injections in multiple files)

Full Detailed Breakdown by Service

If you need to dig into a specific service context later, expand the boxes below:

=services/feed-requests & services/user-feeds=

  • Critical / High Priorities
  • Mongoose: Search injection & Filter Sanitization flaws (#201, #274)
  • @mikro-orm/core & knex: SQL Injection via identifiers/crafted objects (#262, #397, #410)
  • @fastify/middie: Middleware authentication/path bypasses (#271, #405, #221, #357)
  • @nestjs/platform-fastify: HEAD request & URL encoding middleware bypasses (#253, #301, #245)
  • undici: WebSocket client memory leaks & fragment count DoS (#252, #249, #303, #383)
  • fast-xml-parser: DoS & entity limits bypasses (Partial fix for CVE-2026-26278) (#242, #255, #373)
  • protobufjs: Prototype pollution gadgets, recursion DoS, and code injections (#282, #284, #415)
  • Other utilities affected: form-data, fast-uri, minimatch, path-to-regexp, serialize-javascript, flatted, lodash, glob.

=services/backend-api & client bundle=

-Critical / High Priorities

  • vitest / @vitest/browser: Arbitrary file execution via UI server / Browser mode RCE (#67, #73)
  • vite: Dev server WebSocket arbitrary file read & query filter bypasses (#60, #61, #71)
  • handlebars: JavaScript injection via AST Type Confusion, dynamic partials, and block tampering (#104, #107, #105)
  • nodemailer: addressparser DoS and file/URL access control check bypasses (#75, #125)
  • undici: WebSocket 64-bit length parser crashes & memory consumption leaks (#98, #91)
  • Other utilities affected: rollup, happy-dom, flatted, minimatch, picomatch, @remix-run/router, lodash, fast-xml-parser, fastify.

=Remaining Packages & Shared Libraries=

  • services/user-feeds-next: Affected by fast-xml-parser injection (#313), undici WebSocket overflows, and fastify tab character body bypasses.
  • services/discord-rest-listener: Flagged for @mikro-orm/core SQL Injection (#179) and undici leaks.
  • services/bot-presence: High alerts on undici and ws memory exhaustion flaws via small data chunks.
  • packages/logger: Critically relies on an old form-data package with unsafe boundary randomization (#7).

Note: I don't place low/moderate severity utilities (qs, js-yaml, brace-expansion, tmp, etc.) on the listsas it become too too much.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions