npm audit security warning #1615

rosko · 2018-12-31T19:32:59Z

Operating System: All
Node Version: Any
NPM Version: Any
webpack Version:
webpack-dev-server Version: <=3.1.14

This is a bug
This is a modification request

https://www.npmjs.com/advisories/725

                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Missing Origin Validation                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.1.11                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack-dev-server [dev]                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/725                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

The text was updated successfully, but these errors were encountered:

maddev0 · 2018-12-31T20:26:52Z

I have the same issue. I have tried: npm audit fix, manual update of webpack-dev-server to version 3.1.14, removal of node_modules and package-lock.json. Nothing of this helps.

With webpack-dev-server version 3.1.10 initially installed npm audit fix says

+ [email protected]
updated 1 package in 3.517s
fixed 1 of 1 vulnerability...

But then npm audit still reports about 1 high severity vulnerability:

                       === npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Missing Origin Validation                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.1.11                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack-dev-server [dev]                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/725                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 high severity vulnerability in 9001 scanned packages
  1 vulnerability requires manual review. See the full report for details.

SharakPL · 2018-12-31T20:47:53Z

It's probably caused by #1604

O-J1 · 2019-01-01T10:09:16Z

Still getting this issue despite the fact that I am on v3.1.14. Reinstalling does nothing

pauldraper · 2019-01-01T17:31:54Z

The npmjs advisory is currently inconsistent and there is no 3.1.x patch that npm audit will allow.

https://npm.community/t/advisory-725-inconsistently-marks-affected-versions/4333

manishaggarwalm · 2019-01-02T09:40:24Z

Not working with [email protected]

skreborn · 2019-01-02T10:13:55Z

@antimodern Don't worry, you're not being hacked. As you can see, it's trying to access a local address - most likely your own computer. The reason it fails to do so is because you've disconnected from the network, and your computer lost its IP address.

charlesfaustin · 2019-01-02T10:47:42Z

I'm getting the same issue, updating to 3.1.14 doesnt solve the issue, npm audit still returns the vulnerability after updating

Diaan · 2019-01-02T11:02:50Z

there seems to be a typo in the vulnerability database: https://npm.community/t/npm-audit-sweems-to-get-semver-wrong/4352/4

manishaggarwalm · 2019-01-02T11:22:51Z

there seems to be a typo in the vulnerability database: https://npm.community/t/npm-audit-sweems-to-get-semver-wrong/4352/4

You saved my rest of the day

charlesfaustin · 2019-01-02T15:17:17Z

there seems to be a typo in the vulnerability database: https://npm.community/t/npm-audit-sweems-to-get-semver-wrong/4352/4

how can we get this typo fixed? some builds require npm audit returning a clean bill of health

Diaan · 2019-01-02T15:20:24Z

how can we get this typo fixed? some builds require npm audit returning a clean bill of health

Not sure, but the link in my previous post is a bug-report at NPM, so maybe voting on it will help it getting resolved faster.

charlesfaustin · 2019-01-02T15:23:52Z

how can we get this typo fixed? some builds require npm audit returning a clean bill of health

Not sure, but the link in my previous post is a bug-report at NPM, so maybe voting on it will help it getting resolved faster.

done, thanks

manishaggarwalm · 2019-01-02T15:25:15Z

Either wepack and create a new version with 3.2.0 like that would help?

On Wed, 2 Jan 2019 at 8:53 PM, Charles Freduah ***@***.***> wrote: how can we get this typo fixed? some builds require npm audit returning a clean bill of health Not sure, but the link in my previous post is a bug-report at NPM, so maybe voting on it will help it getting resolved faster. done, thanks — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1615 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ApssRpxYQLaW0cLasw6nAvOm62wKYmDqks5u_M8NgaJpZM4Zlnt5> .

-- *Thanks & Regards,Manish AggarwalMb: +919802551120* *Skype: manish.aggarwalm*

SyedFarhan · 2019-01-02T15:30:03Z

Either wepack and create a new version with 3.2.0 like that would help?

I would just wait for the NPM audit team to fix this. This is a widely used dependency so I'm sure they'll have it fixed in a few hours.

Diaan · 2019-01-02T15:30:57Z

Either wepack and create a new version with 3.2.0 like that would help?

probably not, unless they are releasing version 3.110.1 ;)

manishaggarwalm · 2019-01-02T15:31:18Z

Okay thanks let them do before its late

On Wed, 2 Jan 2019 at 9:00 PM, Syed Farhan ***@***.***> wrote: Either wepack and create a new version with 3.2.0 like that would help? I would just wait for the NPM audit team to fix this. This is widely used dependency so I'm sure they'll have it fixed in a few hours. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1615 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ApssRl7Zn_QJkj6H6cBJptPV75A7reemks5u_NCAgaJpZM4Zlnt5> .

-- *Thanks & Regards,Manish AggarwalMb: +919802551120* *Skype: manish.aggarwalm*

Diaan · 2019-01-02T16:06:01Z

I think it is fixed, the audit passes for me.

rosko · 2019-01-02T17:16:09Z

Cool, thank you all!

tshravan86 · 2019-01-07T01:01:26Z

I'm still getting the error. Can someone please help me how to resolve this issue? Thanks.

nelson1212 · 2019-01-07T05:39:42Z

Hi @tshravan86. You must update the version of "webpack-dev-server" to 3.1.14 in the following files: package-lock.json and package.json. in all occurrences. Finally, run "npm update"

it works for me

smlombardi · 2019-01-07T14:55:52Z

@nelson1212 note that npm update will update all your package to their latest versions, which might not be what you want

chimericdream · 2019-01-07T15:18:22Z

If you want to do a more targeted update (and you tend to save exact version numbers in your package.json), here is what I did:

Update webpack-dev-server version in package.json
Delete package-lock.json
Delete the node_modules directory
Run npm i to re-fetch everything and write a new package-lock.json

Alternatively, if you use caret notation for your dependencies and want to be certain that only webpack-dev-server is updated, follow what @nelson1212 suggested with the following change:

Update package.json and package-lock.json as @nelson1212 described
Blow away node_modules
Run npm i

tshravan86 · 2019-01-08T04:48:51Z

@nelson1212 Thanks for your help, it worked. @chimericdream thanks for your information. Need to change the version number at package-lock.json as well. Thanks once again.

nelson1212 · 2019-01-08T15:38:57Z

@nelson1212 Thanks for your help, it worked. @chimericdream thanks for your information. Need to change the version number at package-lock.json as well. Thanks once again.

My pleasure

danzlarkin mentioned this issue Jan 1, 2019

npm High severity vulnerability from webpack-dev-server vuejs/vue-cli#3223

Closed

ericmartinezr mentioned this issue Jan 1, 2019

npm audit found 1 high severity vulnerability in @angular-devkit/build-angular > webpack-dev-server angular/angular#27882

Closed

charlesfaustin mentioned this issue Jan 2, 2019

webpack-dev-server vulnerability angular/angular-cli#13342

Closed

rosko closed this as completed Jan 2, 2019

orenyodfat mentioned this issue Jan 6, 2019

"webpack-dev-server": "^3.1.14" daostack/dutchx-bootstrapper-ui#10

Closed

marc-wilson mentioned this issue Jan 9, 2019

npm audit shows webpack-dev-server as vulnerably nrwl/nx#971

Closed

AliTopal89 mentioned this issue Jan 11, 2019

Update webpack AliTopal89/react_fundamentals#1

Merged

N6REJ mentioned this issue Oct 29, 2019

fix: webpack vulnerability fix nhn/tui.editor#665

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

npm audit security warning #1615

npm audit security warning #1615

rosko commented Dec 31, 2018 •

edited

Loading

maddev0 commented Dec 31, 2018

SharakPL commented Dec 31, 2018

O-J1 commented Jan 1, 2019

pauldraper commented Jan 1, 2019

manishaggarwalm commented Jan 2, 2019

skreborn commented Jan 2, 2019

charlesfaustin commented Jan 2, 2019

Diaan commented Jan 2, 2019

manishaggarwalm commented Jan 2, 2019

charlesfaustin commented Jan 2, 2019

Diaan commented Jan 2, 2019

charlesfaustin commented Jan 2, 2019

manishaggarwalm commented Jan 2, 2019 via email

SyedFarhan commented Jan 2, 2019 •

edited

Loading

Diaan commented Jan 2, 2019 •

edited

Loading

manishaggarwalm commented Jan 2, 2019 via email

Diaan commented Jan 2, 2019

rosko commented Jan 2, 2019

tshravan86 commented Jan 7, 2019

nelson1212 commented Jan 7, 2019 •

edited

Loading

smlombardi commented Jan 7, 2019

chimericdream commented Jan 7, 2019

tshravan86 commented Jan 8, 2019

nelson1212 commented Jan 8, 2019

npm audit security warning #1615

npm audit security warning #1615

Comments

rosko commented Dec 31, 2018 • edited Loading

maddev0 commented Dec 31, 2018

SharakPL commented Dec 31, 2018

O-J1 commented Jan 1, 2019

pauldraper commented Jan 1, 2019

manishaggarwalm commented Jan 2, 2019

skreborn commented Jan 2, 2019

charlesfaustin commented Jan 2, 2019

Diaan commented Jan 2, 2019

manishaggarwalm commented Jan 2, 2019

charlesfaustin commented Jan 2, 2019

Diaan commented Jan 2, 2019

charlesfaustin commented Jan 2, 2019

manishaggarwalm commented Jan 2, 2019 via email

SyedFarhan commented Jan 2, 2019 • edited Loading

Diaan commented Jan 2, 2019 • edited Loading

manishaggarwalm commented Jan 2, 2019 via email

Diaan commented Jan 2, 2019

rosko commented Jan 2, 2019

tshravan86 commented Jan 7, 2019

nelson1212 commented Jan 7, 2019 • edited Loading

smlombardi commented Jan 7, 2019

chimericdream commented Jan 7, 2019

tshravan86 commented Jan 8, 2019

nelson1212 commented Jan 8, 2019

rosko commented Dec 31, 2018 •

edited

Loading

SyedFarhan commented Jan 2, 2019 •

edited

Loading

Diaan commented Jan 2, 2019 •

edited

Loading

nelson1212 commented Jan 7, 2019 •

edited

Loading