Skip to content

fix(security): resolve uuid buffer bounds CVE via npm override#251

Merged
sujayintugle merged 1 commit into
mainfrom
fix/cve-jun-30
Jun 30, 2026
Merged

fix(security): resolve uuid buffer bounds CVE via npm override#251
sujayintugle merged 1 commit into
mainfrom
fix/cve-jun-30

Conversation

@raphael-intugle

Copy link
Copy Markdown
Collaborator

Summary

Fixes npm audit alert for uuid missing buffer bounds check vulnerability (GHSA-w5hq-g745-h8pq, CVE-related).

Changes

  • Add uuid ^11.1.1 override to docsite/package.json overrides section
  • Update docsite/package-lock.json: uuid 8.3.2 → 11.1.1
  • Resolves: "Missing buffer bounds check in v3/v5/v6 when buf is provided" (CWE-787, CWE-1285)

Affected Package

  • uuid: 8.3.2 → 11.1.1
  • Path: docsite/ (npm dependencies)
  • Why: Transitive dependency via @docusaurus/core → webpack-dev-server → sockjs → uuid

Testing

  • ✅ npm audit: uuid advisory cleared
  • ✅ npm run typecheck: Passed
  • ✅ npm run build: Success (generated static files)
  • ✅ No breaking changes to docsite

Notes

  • The vulnerable uuid v8.3.2 was pulled in transitively through the Docusaurus build toolchain
  • npm audit fix could not resolve this automatically (fixAvailable: false)
  • Override in package.json ensures uuid is always ≥11.1.1 across the dependency tree
  • One unrelated moderate vulnerability remains (js-yaml in gray-matter)

- Add uuid ^11.1.1 override in docsite/package.json
- Update package-lock.json: uuid 8.3.2 -> 11.1.1
- Resolves: Missing buffer bounds check in v3/v5/v6 when buf is provided
- Verified: npm audit passes uuid check, build & typecheck pass
@sujayintugle sujayintugle merged commit 5a8cc9b into main Jun 30, 2026
5 checks passed
@sujayintugle sujayintugle deleted the fix/cve-jun-30 branch June 30, 2026 09:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants