Skip to content

fix(deps): vuln minor upgrades — 11 packages (minor: 5 · patch: 6) [package.json] - #97

Draft
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/0-1787644433
Draft

fix(deps): vuln minor upgrades — 11 packages (minor: 5 · patch: 6) [package.json]#97
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/0-1787644433

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Aug 25, 2026

Copy link
Copy Markdown

Summary: High-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

  • package.json (npm)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
undici 7.22.0 7.29.0 minor Transitive 10 HIGH, 18 MEDIUM, 4 LOW
undici 6.23.0 6.28.0 minor Transitive 8 HIGH, 12 MEDIUM, 4 LOW
brace-expansion 2.0.2 2.1.4 minor Transitive 6 HIGH, 2 MEDIUM
brace-expansion 1.1.12 1.1.18 patch Transitive 6 HIGH, 2 MEDIUM
lodash 4.17.23 4.18.1 minor Transitive 4 HIGH, 4 MEDIUM
js-yaml 3.14.2 3.15.1 minor Transitive 3 HIGH, 2 MEDIUM
js-yaml 4.1.1 4.3.1 minor Transitive 3 HIGH, 2 MEDIUM
fast-xml-parser 5.5.3 5.11.0 minor Transitive 2 HIGH, 4 MEDIUM
picomatch 2.3.1 2.3.2 patch Transitive 2 HIGH, 2 MEDIUM
picomatch 4.0.3 4.0.5 patch Transitive 2 HIGH, 2 MEDIUM
fast-xml-builder 1.1.2 1.1.9 patch Transitive 2 HIGH
flatted 3.4.1 3.4.4 patch Transitive 2 HIGH
form-data 2.5.5 2.5.6 patch Transitive 2 HIGH
yaml 2.8.2 2.8.4 patch Transitive 2 MEDIUM
@babel/core 7.29.0 7.29.7 patch Transitive 2 LOW

Security Details

🚨 Critical & High Severity (52 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 1.1.12 - -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.2 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 2.0.2 5.0.8 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 2.0.2 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 1.1.12 5.0.8 -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.2 1.1.18 -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 2.0.2 5.0.7 -
brace-expansion CVE-2026-13149 HIGH - 2.0.2 - -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.12 - -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.12 1.1.18 -
brace-expansion CVE-2026-13149 HIGH - 1.1.12 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 1.1.12 5.0.7 -
fast-xml-builder GHSA-5wm8-gmm8-39j9 HIGH fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes 1.1.2 1.1.7 -
fast-xml-builder CVE-2026-44665 HIGH fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes 1.1.2 - -
fast-xml-parser GHSA-8gc5-j5rx-235r HIGH fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 5.5.3 5.5.6 -
fast-xml-parser CVE-2026-33036 HIGH fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 5.5.3 - -
flatted GHSA-rf6f-7fwh-wjgh HIGH Prototype Pollution via parse() in NodeJS flatted 3.4.1 3.4.2 -
flatted CVE-2026-33228 HIGH flatted: Prototype Pollution via parse() 3.4.1 - -
form-data CVE-2026-12143 HIGH form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) 2.5.5 - -
form-data GHSA-hmw2-7cc7-3qxx HIGH form-data: CRLF injection in form-data via unescaped multipart field names and filenames 2.5.5 2.5.6 -
js-yaml CVE-2026-59869 HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 4.1.1 - -
js-yaml GHSA-5p4m-2wfm-xmqj HIGH JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported 4.1.1 4.3.1 -
js-yaml GHSA-5p4m-2wfm-xmqj HIGH JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported 3.14.2 4.3.1 -
js-yaml GHSA-52cp-r559-cp3m HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 4.1.1 3.15.0 -
js-yaml GHSA-52cp-r559-cp3m HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.2 3.15.0 -
js-yaml CVE-2026-59869 HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.2 - -
lodash CVE-2026-4800 HIGH lodash vulnerable to Code Injection via _.template imports key names 4.17.23 - -
lodash GHSA-35jh-r3h4-6jhm HIGH Command Injection in lodash 4.17.23 4.17.21 -
lodash GHSA-r5fr-rjxr-66jc HIGH lodash vulnerable to Code Injection via _.template imports key names 4.17.23 4.18.0 -
lodash CVE-2021-23337 HIGH - 4.17.23 - -
picomatch GHSA-c2c7-rcm5-vvqj HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 4.0.3 4.0.4 -
picomatch CVE-2026-33671 HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 4.0.3 - -
picomatch GHSA-c2c7-rcm5-vvqj HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 2.3.1 4.0.4 -
picomatch CVE-2026-33671 HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 2.3.1 - -
undici CVE-2026-13697 HIGH undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives 7.22.0 - -
undici GHSA-vxpw-j846-p89q HIGH undici WebSocket client vulnerable to denial of service via fragment count bypass 7.22.0 6.27.0 -
undici GHSA-vrm6-8vpv-qv8q HIGH Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression 7.22.0 6.24.0 -
undici CVE-2026-1526 HIGH undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression 7.22.0 - -
undici GHSA-f269-vfmq-vjvj HIGH Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client 6.23.0 6.24.0 -
undici CVE-2026-1528 HIGH undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client 6.23.0 - -
undici GHSA-4cwx-7wf7-3272 HIGH undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives 7.22.0 7.29.0 -
undici GHSA-vxpw-j846-p89q HIGH undici WebSocket client vulnerable to denial of service via fragment count bypass 6.23.0 6.27.0 -
undici CVE-2026-12151 HIGH undici WebSocket client vulnerable to denial of service via fragment count bypass 7.22.0 - -
undici GHSA-v9p9-hfj2-hcw8 HIGH Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation 7.22.0 6.24.0 -
undici CVE-2026-12151 HIGH undici WebSocket client vulnerable to denial of service via fragment count bypass 6.23.0 - -
undici GHSA-v9p9-hfj2-hcw8 HIGH Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation 6.23.0 6.24.0 -
undici GHSA-vrm6-8vpv-qv8q HIGH Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression 6.23.0 6.24.0 -
undici CVE-2026-2229 HIGH undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation 6.23.0 - -
undici CVE-2026-1526 HIGH undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression 6.23.0 - -
undici CVE-2026-2229 HIGH undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation 7.22.0 - -
undici GHSA-f269-vfmq-vjvj HIGH Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client 7.22.0 6.24.0 -
undici CVE-2026-1528 HIGH undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client 7.22.0 - -
ℹ️ Other Vulnerabilities (62)
Package CVE Severity Summary Unsafe Version Fixed In Case
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.2 - -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.2 5.0.5 -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.12 5.0.5 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.12 - -
fast-xml-parser GHSA-jp2q-39xq-3w4g MODERATE Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser 5.5.3 4.5.5 -
fast-xml-parser CVE-2026-41650 MODERATE fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 5.5.3 - -
fast-xml-parser GHSA-gh4j-gqv2-49f6 MODERATE fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 5.5.3 5.7.0 -
fast-xml-parser CVE-2026-33349 MODERATE fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation 5.5.3 - -
js-yaml GHSA-h67p-54hq-rp68 MODERATE JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.2 4.2.0 -
js-yaml CVE-2026-53550 MODERATE js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases 4.1.1 - -
js-yaml GHSA-h67p-54hq-rp68 MODERATE JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases 4.1.1 4.2.0 -
js-yaml CVE-2026-53550 MODERATE js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.2 - -
lodash GHSA-xxjr-mmjv-4gpg MODERATE Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions 4.17.23 4.17.23 -
lodash CVE-2026-2950 MODERATE lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit 4.17.23 - -
lodash CVE-2025-13465 MODERATE Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions 4.17.23 - -
lodash GHSA-f23m-r3pf-42rh MODERATE lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit 4.17.23 4.18.0 -
picomatch GHSA-3v7f-55p6-f55p MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 2.3.1 4.0.4 -
picomatch CVE-2026-33672 MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 2.3.1 - -
picomatch GHSA-3v7f-55p6-f55p MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 4.0.3 4.0.4 -
picomatch CVE-2026-33672 MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 4.0.3 - -
undici CVE-2026-16728 MODERATE undici vulnerable to downstream response desynchronization via retry interceptor 7.22.0 - -
undici GHSA-8xcm-r25x-g524 MODERATE undici vulnerable to downstream response desynchronization via retry interceptor 7.22.0 6.28.0 -
undici GHSA-m8rv-5g2x-5cg5 MODERATE undici vulnerable to CRLF Injection via blob-like body 'type' property 6.23.0 6.28.0 -
undici CVE-2026-15157 MODERATE undici vulnerable to CRLF Injection via blob-like body 'type' property 6.23.0 - -
undici GHSA-pr7r-676h-xcf6 MODERATE undici vulnerable to cross-user information disclosure via shared cache whitespace bypass 7.22.0 7.28.0 -
undici CVE-2026-9678 MODERATE undici vulnerable to cross-user information disclosure via shared cache whitespace bypass 7.22.0 - -
undici GHSA-2mjp-6q6p-2qxm MODERATE Undici has an HTTP Request/Response Smuggling issue 6.23.0 6.24.0 -
undici CVE-2026-1525 MODERATE undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') 6.23.0 - -
undici GHSA-p88m-4jfj-68fv MODERATE undici vulnerable to HTTP header injection via Set-Cookie percent-decoding 6.23.0 6.27.0 -
undici CVE-2026-9679 MODERATE undici vulnerable to HTTP header injection via Set-Cookie percent-decoding 6.23.0 - -
undici GHSA-jr45-8vmc-qm54 MODERATE undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives 7.22.0 7.29.0 -
undici CVE-2026-16728 MODERATE undici vulnerable to downstream response desynchronization via retry interceptor 6.23.0 - -
undici GHSA-4992-7rv2-5pvq MODERATE Undici has CRLF Injection in undici via upgrade option 6.23.0 6.24.0 -
undici CVE-2026-1527 MODERATE undici is vulnerable to CRLF Injection via upgrade option 6.23.0 - -
undici GHSA-v3r7-h72x-cjcm MODERATE undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields 6.23.0 6.28.0 -
undici CVE-2026-16729 MODERATE undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields 6.23.0 - -
undici CVE-2026-14643 MODERATE undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives 7.22.0 - -
undici GHSA-4992-7rv2-5pvq MODERATE Undici has CRLF Injection in undici via upgrade option 7.22.0 6.24.0 -
undici GHSA-8xcm-r25x-g524 MODERATE undici vulnerable to downstream response desynchronization via retry interceptor 6.23.0 6.28.0 -
undici CVE-2026-16729 MODERATE undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields 7.22.0 - -
undici GHSA-v3r7-h72x-cjcm MODERATE undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields 7.22.0 6.28.0 -
undici CVE-2026-1527 MODERATE undici is vulnerable to CRLF Injection via upgrade option 7.22.0 - -
undici GHSA-2mjp-6q6p-2qxm MODERATE Undici has an HTTP Request/Response Smuggling issue 7.22.0 6.24.0 -
undici CVE-2026-1525 MODERATE undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') 7.22.0 - -
undici CVE-2026-9679 MODERATE undici vulnerable to HTTP header injection via Set-Cookie percent-decoding 7.22.0 - -
undici GHSA-p88m-4jfj-68fv MODERATE undici vulnerable to HTTP header injection via Set-Cookie percent-decoding 7.22.0 6.27.0 -
undici CVE-2026-2581 MODERATE undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS 7.22.0 - -
undici GHSA-phc3-fgpg-7m6h MODERATE Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS 7.22.0 7.24.0 -
undici CVE-2026-15157 MODERATE undici vulnerable to CRLF Injection via blob-like body 'type' property 7.22.0 - -
undici GHSA-m8rv-5g2x-5cg5 MODERATE undici vulnerable to CRLF Injection via blob-like body 'type' property 7.22.0 6.28.0 -
yaml GHSA-48c2-rrv3-qjmp MODERATE yaml is vulnerable to Stack Overflow via deeply nested YAML collections 2.8.2 2.8.3 -
yaml CVE-2026-33532 MODERATE yaml is vulnerable to Stack Overflow via deeply nested YAML collections 2.8.2 - -
@babel/core CVE-2026-49356 LOW Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core 7.29.0 - -
@babel/core GHSA-4x5r-pxfx-6jf8 LOW @babel/core: Arbitrary File Read via sourceMappingURL Comment 7.29.0 8.0.0-rc.6 -
undici GHSA-g8m3-5g58-fq7m LOW undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching 7.22.0 6.27.0 -
undici CVE-2026-11525 LOW undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching 7.22.0 - -
undici CVE-2026-11525 LOW undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching 6.23.0 - -
undici GHSA-g8m3-5g58-fq7m LOW undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching 6.23.0 6.27.0 -
undici CVE-2026-6733 LOW undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse 7.22.0 - -
undici GHSA-35p6-xmwp-9g52 LOW undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse 7.22.0 6.27.0 -
undici CVE-2026-6733 LOW undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse 6.23.0 - -
undici GHSA-35p6-xmwp-9g52 LOW undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse 6.23.0 6.27.0 -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

adms-custom-action-failed adms-dependency-update adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns adms-npm campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants