security issue in dependency

[wtrzy]

Is there an existing issue for this?

• I have searched the existing issues

Current behavior

Performing npm audit returns security issue inside axios.

# npm audit 
# npm audit report

axios  >=1.3.2
Severity: high
Server-Side Request Forgery in axios - https://github.com/advisories/GHSA-8hc4-vh64-cxmj
fix available via `npm audit fix`
node_modules/axios

1 high severity vulnerability

To address all issues, run:
  npm audit fix

Minimum reproduction code

GHSA-8hc4-vh64-cxmj

Steps to reproduce

1. npm audit
2. npm audit fix
3. npm audit

Expected behavior

npm audit | grep "found 0 vulnerabilities"

Package version

3.0.2

NestJS version

10.4.0

Node.js version

20.12.2

In which operating systems have you tested?

• macOS
• Windows
• Linux

Other

VSCode devcontainer running Oracle Linux 8

[kiknaio]

Issue is related to Axios SSRF vulnerability. Here's more details on that https://security.snyk.io/vuln/SNYK-JS-AXIOS-7361793

[paskaran]

We also facing issues in our Audit pipeline too.. Is there a fix planned ?

[KieranMarienAppfoundry]

We also facing issues in our Audit pipeline too.. Is there a fix planned ?

axios/axios#6539

We need to wait for this pr to merge.

[paskaran]

We also facing issues in our Audit pipeline too.. Is there a fix planned ?

axios/axios#6539

We need to wait for this pr to merge.

Thanks 😃

[SmartByt3r]

We also facing issues in our Audit pipeline too.. Is there a fix planned ?

axios/axios#6539

We need to wait for this pr to merge.

PR already merged 😀

[KieranMarienAppfoundry]

We also facing issues in our Audit pipeline too.. Is there a fix planned ?

axios/axios#6539
We need to wait for this pr to merge.

PR already merged 😀

Yup but they need to release it as V1.7.4. I assumed that would happen after the merge but i seems like there's issues with it. Cause it changes the way some things are handled(not spec compliant I believe). But they are working on a fix.

axios/axios#6463 (comment). axios/axios#6539 (comment).

Once 1.7.4 the bot will automatically update it. (I think)

[kamilmysliwiec]

#1173