Dependency & Actions audit - 2026-08-17

[krakenhavoc]

Automated scan of a fresh shallow clone of main. GitHub Actions workflows, go.mod, and *.tf files were checked but produced no findings (all pinned actions are already on current majors running the Node 24 runtime — actions/checkout@v6, actions/setup-node@v6 with node-version: 24, actions/upload-artifact@v6, docker/login-action@v4, docker/setup-buildx-action@v4, docker/metadata-action@v6, docker/build-push-action@v7, peter-evans/repository-dispatch@v4; and the repo has no go.mod or *.tf files), so those categories are omitted below.

Versions shown are what the committed yarn.lock in each workspace actually resolves to (verified directly against yarn.lock), cross-checked with npm audit/npm outdated run against the same dependency ranges.

npm Dependencies

backend/package.json

Vulnerabilities (npm audit: 37 total — 1 critical, 20 high, 14 moderate, 2 low, across 990 resolved packages):

• handlebars 4.7.8 (transitive, pulled in by ts-jest) — critical: JavaScript injection via AST type confusion, CVSS 9.8 (GHSA-2w6w-674q-4c4q), plus 7 more high/moderate advisories (prototype pollution, decorator-syntax DoS). Entire published 4.x line is affected; dev/test-only exposure via jest.
• nodemailer ^8.0.1 (resolved 8.0.1) — high: jsonTransport bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and SSRF (GHSA-p6gq-j5cr-w38f); SMTP command injection via envelope.size (GHSA-c7w3-x93f-qmm8); TLS certificate validation bypass in OAuth2 token fetch (GHSA-r7g4-qg5f-qqm2). Fixed in 9.0.5 (current package.json range ^8.0.1 cannot reach it without a major bump).
• axios ^1.16.0 (resolved 1.16.0) — high: prototype-pollution gadgets enabling credential theft/request hijacking (GHSA-pf86-5x62-jrwf), NO_PROXY SSRF bypass, ReDoS via cookie name injection, and several more; all fixed ≥1.18.0.
• @nestjs/core, @nestjs/platform-express ^11.1.14 (resolved 11.1.14) — high: NestJS injection advisory (GHSA-36xv-jgw5-4q75) plus transitively bundled path-to-regexp 8.3.0 (ReDoS, GHSA-j3q9-mxjg-w52f) and multer 2.0.2 (DoS via uncontrolled recursion, GHSA-5528-5vmv-3xc2). Fixed by upgrading to @nestjs/core/@nestjs/platform-express ≥11.1.18.
• @nestjs/config, @nestjs/swagger — high, transitively via lodash 4.17.23 (code injection via _.template, GHSA-r5fr-rjxr-66jc) and js-yaml 4.1.1 (quadratic-complexity DoS, GHSA-52cp-r559-cp3m).
• typeorm ^0.3.28 (resolved 0.3.28) — moderate, fixed ≥0.3.31 (already within the current ^0.3.28 range — a yarn upgrade resolves it without a major bump).
• Remaining high-severity findings (fast-xml-parser, fast-uri, minimatch, brace-expansion, flatted, picomatch, form-data, node-forge, serialize-javascript) are further transitive dependencies of the @aws-sdk/*, @nestjs/cli/@nestjs/schematics, and jest/ts-jest toolchains.

Outdated (2+ majors behind latest):

• cloudflare ^5.2.0 (resolved 5.2.0) → latest 7.0.0
• stripe ^20.4.1 (resolved 20.4.1) → latest 22.5.0
• typescript ^5.7.3 (devDependency) → latest 7.0.2 (TypeScript 7 native/Go-based compiler)
• @types/node ^22.10.7 (devDependency) → latest 26.2.0

frontend/package.json

Vulnerabilities (npm audit: 19 total — 2 critical, 13 high, 2 moderate, 2 low, across 461 resolved packages):

• vitest, @vitest/ui ^4.0.18 (resolved 4.0.18, devDependency) — critical: when the Vitest UI dev server is listening, an attacker can read and execute arbitrary files (GHSA-5xrq-8626-4rwp); fixed ≥4.1.0. Dev-only, but notable if the UI server port is ever exposed (e.g. in CI/containers).
• react-router-dom ^7.13.1 (resolved 7.13.1), and its react-router dependency (resolved 7.13.1) — high: vendored turbo-stream deserialization allows unauthenticated RCE via arbitrary constructor invocation (GHSA-49rj-9fvp-4h2h); stored XSS via unescaped Location header on prerendered redirects (GHSA-f22v-gfqf-p8f3); CSRF bypass on PUT/PATCH/DELETE document requests (GHSA-84g9-w2xq-vcv6); open redirect via backslash in <Link>/useNavigate (GHSA-wrjc-x8rr-h8h6). All fixed ≥7.18.0 — installed 7.13.1 is affected by every one of these.
• axios ^1.13.6 (resolved 1.13.6) — high, same advisory family as backend; this floor predates nearly every fix, all resolved ≥1.18.0.
• vite ^7.3.1 (resolved 7.3.1, devDependency) — high: path traversal in optimized-deps .map handling (GHSA-4w7w-66w2-5vf9); server.fs.deny bypass via queries (GHSA-v2wj-q39q-566r); arbitrary file read via dev-server WebSocket (GHSA-p9ff-h696-f583); fixed in patch releases past 7.3.1.
• postcss 8.5.6 (transitive) — high: XSS via unescaped </style> in stringify output plus arbitrary .map file disclosure via sourceMappingURL (GHSA-fxqj-rqcc-2cmp).
• ws 8.19.0 (transitive) — high: uninitialized memory disclosure (GHSA-58qx-3vcg-4xpx) and memory-exhaustion DoS from tiny fragments (GHSA-96hv-2xvq-fx4p).

Outdated (2+ majors behind latest):

• typescript ~5.9.3 (devDependency) → latest 7.0.2
• @types/node ^24.10.1 (devDependency) → latest 26.2.0

shared/package.json

Vulnerabilities (npm audit: 3 high, across 95 resolved packages — all dev-only, transitive to the eslint toolchain, no runtime exposure):

• brace-expansion 5.0.4 — DoS via exponential-time/unbounded-length expansion (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg).
• flatted 3.4.0 — prototype pollution via parse() (GHSA-rf6f-7fwh-wjgh).
• picomatch 4.0.3 — method injection in POSIX character classes and a ReDoS via extglob quantifiers (GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj).

Outdated (2+ majors behind latest):

• typescript ^5.0.0 (devDependency) → latest 7.0.2

---

Highest-priority items: nodemailer (arbitrary file read/SSRF via jsonTransport) and react-router-dom/react-router (unauthenticated RCE via turbo-stream) both have vendor-confirmed fixes and direct production exposure. vitest/@vitest/ui critical is dev-only but trivial to fix (^4.1.0).