Skip to content

fix: resolve flatted security vulnerability (march 22, 2026)#218

Open
0xAxiom wants to merge 1 commit intomainfrom
fix/security-audit-20260322
Open

fix: resolve flatted security vulnerability (march 22, 2026)#218
0xAxiom wants to merge 1 commit intomainfrom
fix/security-audit-20260322

Conversation

@0xAxiom
Copy link
Copy Markdown
Owner

@0xAxiom 0xAxiom commented Mar 23, 2026

What

Fixed high-severity security vulnerability in flatted dependency (<=3.4.1)

Why

The vulnerability includes:

  • Unbounded recursion DoS in parse() revive phase
  • Prototype pollution via parse() in NodeJS flatted

Changes

  • Updated package-lock.json via npm audit fix
  • No breaking changes to functionality
  • Removes deprecated packages (inflight, old glob versions)

Tested

  • ✅ npm audit shows 0 vulnerabilities after fix
  • ✅ Lint-staged hooks pass
  • ✅ No breaking changes to existing functionality

Resolves high-severity security advisory.

- Fixed flatted <=3.4.1 high-severity vulnerability
- Addresses unbounded recursion DoS and prototype pollution issues
- Updated via npm audit fix
- No breaking changes to functionality
@0xAxiom 0xAxiom requested a review from MeltedMindz as a code owner March 23, 2026 00:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant