Repository navigation
v1: clear remaining npm audit advisories (ip-address reachable; hono, @hono/node-server, fast-uri, brace-expansion present but unreachable) #2074
Description
Summary
npm audit against v1/main reports 7 advisories beyond the js-yaml one in #2072. This issue covers the five that are present in the production dependency tree, plus two dev-only stragglers needed to actually reach a clean audit.
Triage conclusion up front: only one of the five is meaningfully reachable. The other four are installed-but-unexercised. None of them individually forces a v1 release; the value here is a clean npm audit so that a future genuine advisory isn't lost in the noise.
Reachable
ip-address <=10.3.0 (high)
server/src/index.ts:43 builds sandboxRateLimiter from express-rate-limit, which calls new Address6(ip) and new Address6(\${ip}/${ipv6Subnet}`) for IPv6 subnet keying (express-rate-limit/dist/index.mjs:3,6,9`). Two of the three advisories are precisely about CIDR-suffix and IPv4-mapped/NAT64 misclassification.
- GHSA-4xrf-jv44-h6hh — CIDR suffix suppresses special-use classification
- GHSA-22jq-vg5j-6vgg — IPv4-mapped/NAT64 misclassification
- GHSA-mwp4-54f8-5fhr — leading-zero octets decoded as decimal
Realistic impact in this codebase is a rate-limit key bypass on /sandbox, not the SSRF the advisory titles imply: req.ip derives from the socket under default trust-proxy settings and the proxy binds localhost. Worth fixing, modest severity in context.
Present in the production tree but not reachable
| Package | Advisory | Why it doesn't bite here |
|---|---|---|
hono <=4.12.33 (mod) |
ReDoS in CORS middleware; memo() SSR cross-user disclosure; proxy helper Connection headers; language middleware DoS |
All four are in middleware. The inspector has no direct hono usage — it arrives only beneath @hono/node-server, and none of that middleware is wired up. |
@hono/node-server <1.19.15 (mod) |
Path traversal in serve-static on Windows via encoded backslash (%5C) |
The SDK's server/streamableHttp.js imports only getRequestListener. serve-static is never touched. |
fast-uri 3.0.0 - 3.1.4 (high) |
Host confusion via backslash authority delimiter | Reached via ajv under the SDK for format: "uri" schema checks. Exploitation needs a validated URI to then be trusted for a host decision; no such path exists here. |
brace-expansion <=1.1.17 (high) |
DoS via unbounded expansion / intermediate arrays | Reached via serve-handler -> minimatch@3.1.5 in client/bin/client.js:6. At serve-handler/src/index.js:59 the call is minimatch(resolvedPath, slashed): the attacker controls the path, but brace-expansion expands the pattern, which comes from config. Not attacker-controlled. |
Dev-only
nanoid <3.3.18 and postcss <=8.5.22 both return empty from npm ls --omit=dev (vite/tailwind build chain). Included only so the audit actually reaches zero.
Fix
Every patched release exists within the current major line, so no major upgrades are required:
| Package | From | To |
|---|---|---|
ip-address |
10.2.0 | 10.5.0 |
hono |
4.12.30 | 4.13.3 |
@hono/node-server |
1.19.14 | 1.19.17 |
fast-uri |
3.1.3 | 3.1.5 |
brace-expansion |
1.1.16 / 5.0.7 | 1.1.18 / 5.0.9 |
nanoid |
3.3.16 | 3.3.18 |
postcss |
8.5.19 | 8.5.26 |
@hono/node-serveris deliberately held at 1.19.17, not the current 2.1.1 — a major bump has no place on a deprecated branch.
As with #2072, the lock entries are patched in place rather than re-resolved, keeping the diff to the affected packages only.
Verification
npm audit reports 0 vulnerabilities. Build, lint, and all suites pass (539 client + 37 server + 85 CLI). The app starts, serves the client through serve-handler (the brace-expansion path), gates proxy auth correctly, and completes a full MCP tools/list + tools/call round-trip through the CLI. The rate limiter — the ip-address consumer — was exercised directly and observed decrementing (X-RateLimit-Remaining: 89 of 100).
Activity
fix(deps): clear remaining npm audit advisories
chore: bump version to 1.0.2
fix(deps): clear remaining npm audit advisories (#2075)
chore: bump version to 1.0.2
chore: bump version to 1.0.2
chore: bump version to 1.0.2 (#2081)