Hi there!
I ran a security scan by dependantbot and noticed quite a few overlapping dependency alerts across the microservices.
Hope those info help you patch issue mentioned.
Critical & Injection Risks
If you only have time to look at a few things, these are the high-impact items that handle direct inputs or risk RCE:
- Bypasses:
fast-xml-parser (Entity encoding bypass / DOCTYPE regex injections in multiple files)
Full Detailed Breakdown by Service
If you need to dig into a specific service context later, expand the boxes below:
=services/feed-requests & services/user-feeds=
- Critical / High Priorities
- Mongoose: Search injection & Filter Sanitization flaws (
#201, #274)
- @mikro-orm/core & knex: SQL Injection via identifiers/crafted objects (
#262, #397, #410)
- @fastify/middie: Middleware authentication/path bypasses (
#271, #405, #221, #357)
- @nestjs/platform-fastify: HEAD request & URL encoding middleware bypasses (
#253, #301, #245)
- undici: WebSocket client memory leaks & fragment count DoS (
#252, #249, #303, #383)
- fast-xml-parser: DoS & entity limits bypasses (Partial fix for CVE-2026-26278) (
#242, #255, #373)
- protobufjs: Prototype pollution gadgets, recursion DoS, and code injections (
#282, #284, #415)
- Other utilities affected:
form-data, fast-uri, minimatch, path-to-regexp, serialize-javascript, flatted, lodash, glob.
=services/backend-api & client bundle=
-Critical / High Priorities
- vitest / @vitest/browser: Arbitrary file execution via UI server / Browser mode RCE (
#67, #73)
- vite: Dev server WebSocket arbitrary file read & query filter bypasses (
#60, #61, #71)
- handlebars: JavaScript injection via AST Type Confusion, dynamic partials, and block tampering (
#104, #107, #105)
- nodemailer: addressparser DoS and file/URL access control check bypasses (
#75, #125)
- undici: WebSocket 64-bit length parser crashes & memory consumption leaks (
#98, #91)
- Other utilities affected:
rollup, happy-dom, flatted, minimatch, picomatch, @remix-run/router, lodash, fast-xml-parser, fastify.
=Remaining Packages & Shared Libraries=
- services/user-feeds-next: Affected by
fast-xml-parser injection (#313), undici WebSocket overflows, and fastify tab character body bypasses.
- services/discord-rest-listener: Flagged for
@mikro-orm/core SQL Injection (#179) and undici leaks.
- services/bot-presence: High alerts on
undici and ws memory exhaustion flaws via small data chunks.
- packages/logger: Critically relies on an old
form-data package with unsafe boundary randomization (#7).
Note: I don't place low/moderate severity utilities (qs, js-yaml, brace-expansion, tmp, etc.) on the listsas it become too too much.
Hi there!
I ran a security scan by dependantbot and noticed quite a few overlapping dependency alerts across the microservices.
Hope those info help you patch issue mentioned.
Critical & Injection Risks
If you only have time to look at a few things, these are the high-impact items that handle direct inputs or risk RCE:
SQL / NoSQL Injections
(SQL Injection via crafted objects infeed-requests,user-feeds,discord-rest-listener)mongoose(Search injection vulnerability infeed-requests`)Remote Code Execution (RCE) / Logic Bypass:**
vitest/@vitest/browser(Arbitrary file read/RCE when UI server listens inbackend-api/client)handlebars(JavaScript Injection via AST Type Confusion inbackend-api)@fastify/middie(Middleware auth bypass in plugin scopes across multiple services)fast-xml-parser(Entity encoding bypass / DOCTYPE regex injections in multiple files)Full Detailed Breakdown by Service
If you need to dig into a specific service context later, expand the boxes below:
=services/feed-requests & services/user-feeds=
#201,#274)#262,#397,#410)#271,#405,#221,#357)#253,#301,#245)#252,#249,#303,#383)#242,#255,#373)#282,#284,#415)form-data,fast-uri,minimatch,path-to-regexp,serialize-javascript,flatted,lodash,glob.=services/backend-api & client bundle=
-Critical / High Priorities
#67,#73)#60,#61,#71)#104,#107,#105)#75,#125)#98,#91)rollup,happy-dom,flatted,minimatch,picomatch,@remix-run/router,lodash,fast-xml-parser,fastify.=Remaining Packages & Shared Libraries=
fast-xml-parserinjection (#313),undiciWebSocket overflows, andfastifytab character body bypasses.@mikro-orm/coreSQL Injection (#179) andundicileaks.undiciandwsmemory exhaustion flaws via small data chunks.form-datapackage with unsafe boundary randomization (#7).Note: I don't place low/moderate severity utilities (
qs,js-yaml,brace-expansion,tmp, etc.) on the listsas it become too too much.