[Snyk] Fix for 124 vulnerabilities by TheRedHatter · Pull Request #383 · TheRedHatter/brokencrystals

TheRedHatter · 2026-08-26T09:56:29Z

Snyk has created this PR to fix 124 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

package.json
package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-12613773
	Prototype Pollution SNYK-JS-AXIOS-15252993
	Unintended Proxy or Intermediary ('Confused Deputy') SNYK-JS-AXIOS-15965856
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-16298162
	Prototype Pollution SNYK-JS-AXIOS-16299904
	Uncontrolled Recursion SNYK-JS-AXIOS-16299923
	Prototype Pollution SNYK-JS-AXIOS-17111060
	Prototype Pollution SNYK-JS-AXIOS-17111079
	Prototype Pollution SNYK-JS-AXIOS-17111081
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-17172532
	Prototype Pollution SNYK-JS-AXIOS-18065355
	Inefficient Algorithmic Complexity SNYK-JS-BRACEEXPANSION-17706650
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18313044
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18512280
	Regular Expression Denial of Service (ReDoS) SNYK-JS-FINDMYWAY-8055229
	Out-of-bounds Read SNYK-JS-LIBXMLJS-10557390
	Improper Input Validation SNYK-JS-LIBXMLJS-10557391
	Use After Free SNYK-JS-LIBXMLJS-10557401
	Use After Free SNYK-JS-LIBXMLJS-10557403
	NULL Pointer Dereference SNYK-JS-LIBXMLJS-10557404
	Out-of-bounds Read SNYK-JS-LIBXMLJS-10557406
	Improper Input Validation SNYK-JS-LIBXMLJS-10557407
	Memory Leak SNYK-JS-LIBXMLJS-10557408
	Out-of-bounds Read SNYK-JS-LIBXMLJS-10557410
	Out-of-Bounds SNYK-JS-LIBXMLJS-10557411
	Out-of-Bounds SNYK-JS-LIBXMLJS-10557414
	Denial of Service (DoS) SNYK-JS-LIBXMLJS-10557417
	Out-of-Bounds SNYK-JS-LIBXMLJS-10557418
	Out-of-Bounds SNYK-JS-LIBXMLJS-10557419
	Use After Free SNYK-JS-LIBXMLJS-10557420
	Out-of-bounds Read SNYK-JS-LIBXMLJS-10557424
	Out-of-bounds Read SNYK-JS-LIBXMLJS-10557425
	Denial of Service (DoS) SNYK-JS-LIBXMLJS-10557428
	Denial of Service (DoS) SNYK-JS-LIBXMLJS-10557429
	Out-of-Bounds SNYK-JS-LIBXMLJS-10557430
	Out-of-Bounds SNYK-JS-LIBXMLJS-10557431
	Denial of Service (DoS) SNYK-JS-LIBXMLJS-10557433
	Out-of-Bounds SNYK-JS-LIBXMLJS-10557434
	Out-of-Bounds SNYK-JS-LIBXMLJS-10557436
	Out-of-Bounds SNYK-JS-LIBXMLJS-10557437
	Use After Free SNYK-JS-LIBXMLJS-10557440
	Out-of-bounds Read SNYK-JS-LIBXMLJS-10557441
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-15353387
	Symlink Attack SNYK-JS-TAR-15416075
	Symlink Attack SNYK-JS-TAR-15456201
	Interpretation Conflict SNYK-JS-TAR-17342362
	Infinite loop SNYK-JS-TAR-17909068
	Incorrect Type Conversion or Cast SNYK-JS-TAR-17909104
	Allocation of Resources Without Limits or Throttling SNYK-JS-TAR-17909152
	Uncaught Exception SNYK-JS-TAR-17909225
	Uncaught Exception SNYK-JS-UNDICI-15518070
	CRLF Injection SNYK-JS-UNDICI-15518072
	Improper Neutralization SNYK-JS-UNDICI-18426061
	HTTP Request Smuggling SNYK-JS-UNDICI-18426063
	CRLF Injection SNYK-JS-UNDICI-18426067
	Improper Validation of Specified Index, Position, or Offset in Input SNYK-JS-UUID-16133035
	HTTP Response Splitting SNYK-JS-AXIOS-16298058
	Insertion of Sensitive Information Into Sent Data SNYK-JS-AXIOS-17172681
	XML External Entity (XXE) Injection SNYK-JS-LIBXMLJS-10557412
	Use of Externally-Controlled Format String SNYK-JS-LIBXMLJS-10557422
	SQL Injection SNYK-JS-MIKROORMCORE-15916609
	Insufficient Session Expiration SNYK-JS-FASTIFYSESSION-6969137
	Out-of-bounds Write SNYK-JS-LIBXMLJS-10557402
	Use After Free SNYK-JS-LIBXMLJS-10557432
	Allocation of Resources Without Limits or Throttling SNYK-JS-FASTIFYMULTIPART-8660811
	Cross-site Request Forgery (CSRF) SNYK-JS-AXIOS-6032459
	Out-of-bounds Write SNYK-JS-LIBXMLJS-10557439
	Allocation of Resources Without Limits or Throttling SNYK-JS-AXIOS-16298130
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-6124857
	Interpretation Conflict SNYK-JS-NODEMAILER-13378253
	Prototype Pollution SNYK-JS-MIKROORMCORE-15917139
	Improper Encoding or Escaping of Output SNYK-JS-AXIOS-16298055
	Prototype Pollution SNYK-JS-AXIOS-16299925
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-17111062
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-9292519
	Insertion of Sensitive Information Into Sent Data SNYK-JS-AXIOS-17172930
	Improper Input Validation SNYK-JS-LIBXMLJS-10557405
	Denial of Service (DoS) SNYK-JS-LIBXMLJS-10557413
	Deserialization of Untrusted Data SNYK-JS-LIBXMLJS-10557421
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-15309438
	Inefficient Algorithmic Complexity SNYK-JS-MINIMATCH-15353389
	Improper Handling of Highly Compressed Data (Data Amplification) SNYK-JS-UNDICI-15518068
	SQL Injection SNYK-JS-KNEX-3175610
	HTTP Response Splitting SNYK-JS-AXIOS-15969258
	Directory Traversal SNYK-JS-TAR-15307072
	Insertion of Sensitive Information Into Sent Data SNYK-JS-AXIOS-16299478
	Use of a Broken or Risky Cryptographic Algorithm SNYK-JS-JSONWEBTOKEN-3180026
	Improper Restriction of Security Token Assignment SNYK-JS-JSONWEBTOKEN-3180024
	Out-of-Bounds SNYK-JS-LIBXMLJS-10557389
	Denial of Service (DoS) SNYK-JS-LIBXMLJS-10557409
	Denial of Service (DoS) SNYK-JS-LIBXMLJS-10557415
	Out-of-bounds Read SNYK-JS-LIBXMLJS-10557416
	Improper Authentication SNYK-JS-JSONWEBTOKEN-3180022
	Arbitrary Code Injection SNYK-JS-NESTJSCOMMON-9538801
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-9403194
	Command Injection SNYK-JS-GLOB-14040952
	CRLF Injection SNYK-JS-UNDICI-17372658
	Excessive Platform Resource Consumption within a Loop SNYK-JS-BRACES-6838727
	Denial of Service (DoS) SNYK-JS-WS-7266574
	NULL Pointer Dereference SNYK-JS-LIBXMLJS-10557435
	Infinite loop SNYK-JS-BRACEEXPANSION-15789759
	Allocation of Resources Without Limits or Throttling SNYK-JS-UNDICI-17372754
	XML External Entity (XXE) Injection SNYK-JS-LIBXMLJS-10557423
	Uncontrolled Recursion SNYK-JS-AXIOS-18060730
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106
	Uncontrolled Recursion SNYK-JS-TAR-18319500
	HTTP Request Smuggling SNYK-JS-UNDICI-15518061
	Resource Exhaustion SNYK-JS-JOSE-6419224
	Permissive List of Allowed Inputs SNYK-JS-UNDICI-17372758
	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909
	Improper Handling of Unicode Encoding SNYK-JS-TAR-15038581
	Prototype Pollution SNYK-JS-AXIOS-18065349
	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116
	Directory Traversal SNYK-JS-TAR-15032660
	Prototype Pollution SNYK-JS-UNSETVALUE-2400660
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-16298095
	Denial of Service (DoS) SNYK-JS-GRAPHQL-5905181
	Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060
	Time-of-check Time-of-use (TOCTOU) Race Condition SNYK-JS-UNDICI-17372752
	Directory Traversal SNYK-JS-TAR-15127355
	Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728
	Allocation of Resources Without Limits or Throttling SNYK-JS-UNDICI-14943963
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Prototype Pollution
🦉 Server-side Request Forgery (SSRF)
🦉 More lessons are available in Snyk Learn

TheRedHatter · 2026-08-26T09:56:31Z

This release includes several high-risk major version upgrades that require immediate attention and code modifications. The most critical are the upgrades for NestJS, Mikro-ORM, and jsonwebtoken.

Top 3 Impactful Upgrades

1. NestJS Framework: v9 → v10 (@nestjs/core, @nestjs/common, etc.)
This is a significant framework upgrade with several breaking changes. Key actions include:

Node.js Requirement: Support for Node.js v12 is dropped; Node.js v16+ is now required.
CacheModule: The CacheModule has been extracted from @nestjs/common into its own package, @nestjs/cache-manager. You must install the new package and update your imports.
TypeScript Version: Projects using CLI plugins for Swagger or GraphQL now require TypeScript v4.8 or higher.

Recommendation: Follow the official migration guide, update your Node.js runtime, and refactor CacheModule usage.

2. Mikro-ORM: v4 → v6 (@mikro-orm/core, @mikro-orm/postgresql)
This upgrade spans two major versions (v4→v5 and v5→v6) and introduces substantial breaking changes.

v4 → v5: Node.js v14+ is required. Many core methods like em.find() and em.findOne() now use a single options object instead of multiple arguments. The @Repository() decorator is removed in favor of an entity option.
v5 → v6: Node.js v18.12+ and TypeScript 5.0+ are required. The default loading strategy for SQL drivers is now joined. The MikroORM.init() no longer accepts a Configuration instance, and extensions like Migrator must be registered in the config.

Recommendation: This is a multi-step migration. Carefully follow the official v4-to-v5 and v5-to-v6 upgrade guides. Expect to refactor entity manager calls, configuration, and repository definitions.

3. jsonwebtoken: v8 → v9`
This security-focused update introduces strict, non-backwards-compatible changes to enhance security. [5]

Unsigned Tokens: The verify() function no longer accepts unsigned tokens by default. You must explicitly add 'none' to the algorithms array in the options if this is intended. [6]
Key Validation: Asymmetric keys (RSA/ECDSA) can no longer be used for HMAC algorithms (e.g., HS256). Additionally, RSA keys must now be 2048 bits or greater. [6]

Recommendation: Review all verify() calls. Explicitly specify the algorithms you expect to prevent security bypasses. Ensure your RSA keys meet the new size requirement.

Other Notable Major Upgrades

@mercuriusjs/gateway v1 → v4: This jump likely contains significant breaking changes to the GraphQL gateway setup. Review the changelogs for versions 2, 3, and 4 is highly recommended.
rimraf v3 → v6: Glob pattern support was removed in v4 and then re-added as an opt-in feature. The main function now returns a Promise instead of using a callback. [3, 17, 29]
bcrypt v5 → v6: Drops support for Node.js versions below 16. [22]
@fastify/static v7 → v9: The setHeaders function signature has changed; it now receives the FastifyReply object instead of the raw response object. [18]
libxmljs v0.19.8 → v1.0.0: This is a significant jump to a stable 1.0 release. Review for API changes is critical.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

TheRedHatter · 2026-08-26T09:56:43Z

⛔ Snyk checks have failed. 5 issues have been found so far.

Status	Scan Engine	High	Medium	Total (5)
⛔	Open Source Security	2	3	5 issues
✅	Licenses	0	0	0 issues
✅	Code Security	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

TheRedHatter · 2026-08-26T09:56:48Z

⛔ Snyk checks have failed. 5 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (5)
⛔	Open Source Security	0	2	3	0	5 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

socket-security · 2026-08-26T09:57:57Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
axios@0.28.0
libxmljs@0.19.8 ⏵ 1.0.0	⁺²		⁺⁴		⁺²⁰
@nestjs/platform-fastify@9.3.9 ⏵ 10.3.2	⁺¹			⁺²
@sectester/reporter@0.16.5 ⏵ 0.29.0	⁺¹		⁺¹	^-4
nodemailer@6.9.12 ⏵ 7.0.7		⁺¹	⁺¹	⁺¹
@sectester/scan@0.16.5 ⏵ 0.31.0			⁺¹	^-1
@sectester/core@0.16.5 ⏵ 0.36.1	⁺²			^-4
@mikro-orm/core@6.6.10
@fastify/static@7.0.1 ⏵ 9.0.0	⁺¹	^-2
rimraf@2.7.1 ⏵ 6.1.1			⁺¹	⁺³³
@mercuriusjs/gateway@1.2.0 ⏵ 4.0.0	^-5			⁺²
bcrypt@5.1.0 ⏵ 6.0.0	⁺⁹		⁺¹
jsonwebtoken@8.5.1 ⏵ 9.0.0	⁺¹	⁺¹⁹	⁺¹	⁺⁴
mercurius@12.2.0 ⏵ 13.3.2	⁺¹			^-5
@nestjs/graphql@11.0.0 ⏵ 12.2.0	⁺¹		⁺²	⁺¹¹
@nestjs/config@2.3.1 ⏵ 3.2.3
@fastify/cookie@8.3.0 ⏵ 9.2.0	⁺¹
@fastify/session@10.1.1 ⏵ 10.9.0	⁺¹	⁺¹⁶	⁺¹
jose@4.13.1 ⏵ 4.15.5		⁺²		⁺²
@fastify/multipart@7.4.1 ⏵ 8.3.1	⁺¹	⁺¹⁶	⁺¹	⁺³
@nestjs/core@9.3.9 ⏵ 10.4.2	⁺¹			⁺²
@nestjs/common@9.3.9 ⏵ 10.4.16		⁺²
@nestjs/swagger@6.2.1 ⏵ 7.4.1			⁺¹	⁺³
@mikro-orm/postgresql@4.5.10 ⏵ 5.0.0	⁺²⁶
graphql@16.6.0 ⏵ 16.8.1	⁺¹	⁺²

View full report

Navigation Menu

[Snyk] Fix for 124 vulnerabilities - #383

[Snyk] Fix for 124 vulnerabilities#383
TheRedHatter wants to merge 1 commit into
masterfrom
snyk-fix-4b05d6be33e409dbc3181a0b3bcb0c1a

TheRedHatter commented Aug 26, 2026

Uh oh!

TheRedHatter commented Aug 26, 2026

Uh oh!

TheRedHatter commented Aug 26, 2026 •

edited

Loading

Uh oh!

TheRedHatter commented Aug 26, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

TheRedHatter commented Aug 26, 2026

Snyk has created this PR to fix 124 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

Vulnerabilities that will be fixed with an upgrade:

Breaking Change Risk

Uh oh!

TheRedHatter commented Aug 26, 2026

Top 3 Impactful Upgrades

Other Notable Major Upgrades

Uh oh!

TheRedHatter commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⛔ Snyk checks have failed. 5 issues have been found so far.

Uh oh!

TheRedHatter commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⛔ Snyk checks have failed. 5 issues have been found so far.

Uh oh!

socket-security Bot commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

TheRedHatter commented Aug 26, 2026 •

edited

Loading

TheRedHatter commented Aug 26, 2026 •

edited

Loading