[BUG] CVE-2022-24434 high security vulnerability in platform-express > multer > busboy > dicer

[cyraid]

Information

• Version: 6.114.14
• Packages: @tsed/platform-express > multer > busboy > dicer

There is a high security vulnerability found after doing npm audit, as when I installed it gave me an alert.
GHSA-wm7h-9275-46v2

If I'm not mistaken, for platform-express, shouldn't multer be a peer dependency?

[Romakita]

Hello @cyraid
Look the constraint here: https://github.com/tsedio/tsed/blob/production/packages/platform/platform-express/package.json#L60

The version isn’t fixed. You can install the multer as your own dependencies.

If I'm not mistaken, for platform-express, shouldn't multer be a peer dependency?

I cannot change that without causing a breaking change. And this module is imported in the code. Maybe in v7 I’ll change that.

See you

[cyraid]

I'm using the newest multer in the dependencies but the warning still pops up.

[github-actions]

🎉 Are you happy?

If you appreciated the support, know that it is free and is carried out on personal time ;)

A support, even a little bit makes a difference for me and continues to bring you answers!

[Romakita]

🎉 This issue has been resolved in version 6.114.15 🎉

The release is available on:

• v6.114.15
• GitHub release

Your semantic-release bot 📦🚀

[Romakita]

Maybe you need to use npm dedup.

[cyraid]

That was quick! Though I think 1.4.4 still is affected. The message says it was fixed in 1.4.4-lts.1, and there's also 1.4.5-lts.1 now. npm dedup didn't work for me. :(

npm WARN deprecated [email protected]: Multer 1.x is affected by CVE-2022-24434. This is fixed in v1.4.4-lts.1 which drops support for versions of Node.js before 6. Please upgrade to at least Node.js 6
and version 1.4.4-lts.1 of Multer. If you need support for older versions of Node.js, we are open to accepting patches that would fix the CVE on the main 1.x release line, whilst maintaining compatibility with Node.js 0.10.

Does npm audit not show that for you? Also, thanks for the quick replies! Man you're fast. haha

[Romakita]

Ok i’ll update the dependencies to lts ;)

[Romakita]

It’s strange, if dedup doesn’t works it means you hzven’t duplicated multer. Look in node_modules/@tsed/platform-express/node_modules. Check if you have a multer package.

You have npm 8?

[nabhasalakkat]

I'm using v6.114.15 of platform-express but still getting the @tsed/platform-express > multer > busboy > dicer vulnerability

[Romakita]

yes the PR isn't merged with the latest dependencies. I'll do that ASAP.

[cyraid]

Thank you @Romakita!

[Romakita]

🎉 This issue has been resolved in version 7.0.0-beta.13 🎉

The release is available on:

• v7.0.0-beta.13
• GitHub release

Your semantic-release bot 📦🚀