Nuxt2 Security advisories #9284
Description
While we are working on Nuxt 3 stable release, Nuxt 2 has to keep some dependencies in their older versions to avoid breaking changes. These include webpack@4, postcss@7 and core-js@2
As a result, some sub-dependencies are being obsolete, and eventually, some vulnerabilities are being discovered in them. This doesn't always mean Nuxt is vulnerable since most of them are applicable when untrusted user input is involved while these sub-dependencies in Nuxt are used in the build step and during development only.
You have to take care of these security issues immediately:
| ID | Related Package | Status | Description |
|---|---|---|---|
| GitHub issue | @nuxt/webpack > cssnano > cssnano-preset-default > postcss-svgo > svgo |
Use resolution to prevent installing malicious version | |
| GHSA-pjwm-rvh2-c87w | @nuxt/utils > ua-parser-js |
Update lock file and local cache | |
| vuejs/vue-router#3652 | vue-router |
Update the lockfile to use vue-routeer>=3.5.3 |
This is an informative listing of current safe-to-ignore (false positive) vulnerabilities :
| ID | Related Package | Status |
|---|---|---|
| GHSA-4jqc-8m5r-9rpr | webpack >> set-value |
🔰 Not affecting |
| GHSA-rp65-9cf3-cjxr | webpack >> nth-check |
🔰 Not affecting |
These issues have been solved in the dependency tree. It is advised to renew the lock file (package-lock.json and yarn. lock) to get the fixes.
| ID | Related Package | Status | Description |
|---|---|---|---|
| SNYK-JS-UAPARSERJS-1766952 | |||
| 2021-23368 | postcss@7 |
✅ Fixed | Is only vulnerable for online tools like codepen that directly compile user css (patch notes) |
| 2021-27290 | ssri@6.0.2 |
✅ Fixed | Is only vulnerable to DoS attack if webpack is compiling untrusted code |
| 2021-33502 | normalize-url@<4.5.1, <5.3.1, <6.0.1 |
✅ Fixed | Is only vulnerable to DoS attack if webpack is compiling untrusted code |
| 2021-33587 | css-what@<5.0.1 |
✅ Fixed | Is only vulnerable to DoS attack if @nuxt/generator is processing untrusted code |
| 2021-33502 | normalize-url<4.5.1, 5.3.1, 6.0.1 |
✅ Fixed | Is only vulnerable to DoS attack if extract-css-chunks-webpack-plugin is compiling untrusted css code |
| 2020-28469 | glob-parent<5.1.2 |
✅ Fixed | Is only vulnerable to DoS attack when in an untrusted development environment |
Notes:
- If you are directly using the above dependencies in production or in a solution other than nuxt, they should be considered
- We regularly update lock-file and check advisories using automated GithubActions
- If you found a security issue nuxt sub-dependency which is not mentioned above, please let us know via security [at] nuxtjs.org
- Generally, you should consider security advisories unless mentioned here as safe, if used in a build-only step or you are sure about its safety