fix(security): resolve high-severity vulnerabilities in qs and valibot by taearls · Pull Request #146 · taearls/portfolio

taearls · 2026-01-02T17:06:15Z

Summary

Fix CVE-2025-15284 (qs DoS vulnerability) via npm override
Fix CVE-2025-66020 (valibot ReDoS vulnerability) via react-router update

Vulnerabilities Addressed

CVE	Package	Severity	Fix
CVE-2025-15284	qs	High (7.5)	Override to 6.14.1
CVE-2025-66020	valibot	High	Update react-router to 7.11.0

Changes

qs (Dependabot #27)

Issue: arrayLimit bypass allows DoS via memory exhaustion
Root cause: @cypress/request@3.0.9 pins qs@6.14.0
Fix: Added overrides in package.json to force qs@6.14.1
Follow-up: Remove qs override once @cypress/request updates to qs@6.14.1 #145 tracks removal once upstream merges fix(dep): bump qs to v6.14.1 cypress-io/request#97

valibot

Issue: ReDoS in EMOJI_REGEX validation
Root cause: @react-router/dev@7.9.4 depends on valibot@1.1.0
Fix: Updated react-router and @react-router/dev to 7.11.0, which depends on valibot@^1.2.0

Verification

$ npm audit
found 0 vulnerabilities

$ npm ls qs valibot
├─┬ @react-router/dev@7.11.0
│ └── valibot@1.2.0
└─┬ cypress@15.8.1
  └─┬ @cypress/request@3.0.9
    └── qs@6.14.1 overridden

Test plan

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated routing framework dependencies to the latest compatible version.
- Enhanced dependency resolution configuration for improved package compatibility.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Address 2 high-severity vulnerabilities identified by npm audit: 1. CVE-2025-15284 (qs): DoS via arrayLimit bypass in bracket notation - Added npm overrides to force qs@6.14.1 - Upstream fix pending: cypress-io/request#97 - Tracked in #145 for override removal once upstream releases 2. CVE-2025-66020 (valibot): ReDoS in EMOJI_REGEX - Updated react-router 7.9.4 → 7.11.0 - Updated @react-router/dev 7.9.4 → 7.11.0 - These updates pull in valibot@1.2.0 (fixed version) Both vulnerabilities affect dev dependencies only (Cypress and React Router dev tooling). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

coderabbitai · 2026-01-02T17:06:33Z

Walkthrough

Updates react-router and @react-router/dev dependencies from version ^7.9.4 to ^7.11.0, and adds a top-level overrides block pinning the qs package to version 6.14.1.

Changes

Cohort / File(s)	Summary
Dependency and Override Updates `package.json`	Bumped `react-router` and `@react-router/dev` from ^7.9.4 to ^7.11.0; added top-level `overrides` block with `qs` pinned to 6.14.1

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Possibly related issues

Remove qs override once @cypress/request updates to qs@6.14.1 #145: Addresses the same objective of adding/maintaining the qs 6.14.1 override in package.json dependencies.

Pre-merge checks

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: resolving security vulnerabilities in qs and valibot through dependency updates and npm overrides.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d5c71e2 and 0ab3570.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

package.json

🧰 Additional context used

🧠 Learnings (4)

📓 Common learnings

Learnt from: CR
Repo: taearls/portfolio PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-30T22:04:36.017Z
Learning: Use React Router 7 for client-side routing without server-side rendering

📚 Learning: 2025-12-30T22:04:36.017Z

Learnt from: CR
Repo: taearls/portfolio PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-30T22:04:36.017Z
Learning: Use React Router 7 for client-side routing without server-side rendering

Applied to files:

package.json

📚 Learning: 2025-12-30T22:04:36.017Z

Learnt from: CR
Repo: taearls/portfolio PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-30T22:04:36.017Z
Learning: Use Vite as the build tool with React plugin

Applied to files:

package.json

📚 Learning: 2025-12-30T22:04:36.017Z

Learnt from: CR
Repo: taearls/portfolio PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-30T22:04:36.017Z
Learning: Applies to **/*.{module.css,tsx,ts} : Use TailwindCSS for styling alongside CSS Modules for component-specific styles

Applied to files:

package.json

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

GitHub Check: Test
GitHub Check: Workers Builds: portfolio-feature-flags
GitHub Check: Cloudflare Pages

🔇 Additional comments (2)

package.json (2)

50-52: The qs override to 6.14.1 correctly addresses CVE-2025-15284.

The DoS vulnerability (improper input validation in bracket notation arrays) is fixed in version 6.14.1. Pinning to an exact version is appropriate for security fixes to prevent automatic updates that could reintroduce the vulnerability.

Per PR objectives, this is a temporary workaround pending upstream merge at cypress-io/request#97 (issue #145). Consider adding a comment in package.json to document this temporary nature for future maintainers.

47-47: React Router 7.11.0 and qs overrides correctly address the security vulnerabilities.

React Router 7.11.0 upgrades the valibot dependency to ^1.2.0, fixing the ReDoS vulnerability (CVE-2025-66020) in the EMOJI_REGEX validator. The qs override to 6.14.1 fixes the arrayLimit bypass that allows unbounded array parameters and potential memory exhaustion attacks (CVE-2025-15284). The version synchronization between react-router and @react-router/dev is correct.

Also applies to: 58-58

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cloudflare-workers-and-pages · 2026-01-02T17:07:03Z

Deploying portfolio with Cloudflare Pages

Latest commit:	`0ab3570`
Status:	✅ Deploy successful!
Preview URL:	https://8ab66905.portfolio-next.pages.dev
Branch Preview URL:	https://fix-security-vulnerabilities.portfolio-next.pages.dev

View logs

cloudflare-workers-and-pages · 2026-01-02T17:07:47Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	portfolio-feature-flags	`0ab3570`	Commit Preview URL Branch Preview URL	Jan 02 2026, 05:07 PM

taearls

Summary

This PR addresses 2 high-severity security vulnerabilities identified by Dependabot and npm audit:

CVE-2025-15284 (qs): DoS via arrayLimit bypass in bracket notation
CVE-2025-66020 (valibot): ReDoS vulnerability in EMOJI_REGEX

Changed files: 2 files, +986 additions, -2283 deletions
Impact areas: Dev dependencies (Cypress, React Router tooling)
Review depth: Full validation

Quality Checks Results

✅ ESLint: npm run lint:check - Pass
✅ OxLint: npm run oxlint:check - Pass (3 pre-existing warnings, unrelated to this PR)
✅ Prettier: npm run format:check - Pass
✅ Stylelint: npm run lint:css - Pass
✅ Unit Tests: npm run test - Pass (289/289 tests)
✅ Build: npm run build - Pass
⏭️ E2E Tests: Skipped (no UI changes, dependency-only update)

Code Review Findings

✅ Positive Observations

Appropriate fix strategy: Using npm overrides for the qs vulnerability is the correct approach when upstream hasn't released a fix yet
Minimal changes: Only package.json modified with version bumps and overrides section
Good documentation: PR description clearly explains the vulnerabilities, root causes, and fixes
Follow-up tracking: Issue #145 created to track removal of the override once upstream merges

Security Verification

$ npm audit
found 0 vulnerabilities

$ npm ls qs valibot
├─┬ @react-router/dev@7.11.0
│ └── valibot@1.2.0  ← Fixed (was 1.1.0)
└─┬ cypress@15.8.1
  └─┬ @cypress/request@3.0.9
    └── qs@6.14.1 overridden  ← Fixed (was 6.14.0)

Security Review

✅ No exposed secrets in code or commit history
✅ Dependencies updated to patched versions
✅ Both vulnerabilities are in dev dependencies only (no production impact)
✅ Override is scoped appropriately (only affects qs)

Testing Analysis

Coverage: All 289 existing tests pass
Risk assessment: Low - these are patch/minor version updates to dev dependencies
react-router 7.9.4 → 7.11.0: No breaking changes in this range (verified via changelog)

Recommendations

No changes required. The implementation is clean and follows best practices for addressing transitive dependency vulnerabilities.

Minor note for future: Once cypress-io/request#97 is merged and released, the overrides section can be removed (tracked in #145).

Approval Status

✅ LGTM - Ready to merge

Reasoning:

Both high-severity vulnerabilities are properly addressed
All quality checks pass
Minimal, focused changes with clear documentation
Follow-up tracking in place for override removal

Review completed using: npm run lint:check, npm run oxlint:check, npm run format:check, npm run lint:css, npm run test, npm run build, npm audit
Reviewed by: Claude Code Agent

taearls commented Jan 2, 2026

View reviewed changes

taearls merged commit 45135ad into main Jan 2, 2026
10 checks passed

taearls deleted the fix/security-vulnerabilities-qs-valibot branch January 2, 2026 17:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): resolve high-severity vulnerabilities in qs and valibot#146

fix(security): resolve high-severity vulnerabilities in qs and valibot#146
taearls merged 1 commit intomainfrom
fix/security-vulnerabilities-qs-valibot

taearls commented Jan 2, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Jan 2, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages bot commented Jan 2, 2026

Uh oh!

cloudflare-workers-and-pages bot commented Jan 2, 2026

Uh oh!

taearls left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

taearls commented Jan 2, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Vulnerabilities Addressed

Changes

qs (Dependabot #27)

valibot

Verification

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Pre-merge checks

Uh oh!

cloudflare-workers-and-pages bot commented Jan 2, 2026

Deploying portfolio with Cloudflare Pages

Uh oh!

cloudflare-workers-and-pages bot commented Jan 2, 2026

Deploying with Cloudflare Workers

Uh oh!

taearls left a comment

Choose a reason for hiding this comment

Summary

Quality Checks Results

Code Review Findings

✅ Positive Observations

Security Verification

Security Review

Testing Analysis

Recommendations

Approval Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

taearls commented Jan 2, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Jan 2, 2026 •

edited

Loading