10
  • I cloned my repo for a react app.
  • Ran npm i
  • Received 3 high severity warnings.
  • On attempt to fix (npm audit fix --force) I get 31 vulnerabilities in total

Here are the warnings:

npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN deprecated @hapi/topo@3.1.6: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated @hapi/bourne@1.3.2: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2.
npm WARN deprecated chokidar@2.1.8: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.
npm WARN deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2.
npm WARN deprecated chokidar@2.1.8: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.
npm WARN deprecated babel-eslint@10.1.0: babel-eslint is now @babel/eslint-parser. This package will no longer receive updates.
npm WARN deprecated @hapi/address@2.1.4: Moved to 'npm install @sideway/address'
npm WARN deprecated rollup-plugin-babel@4.4.0: This package has been deprecated and is no longer maintained. Please use @rollup/plugin-babel.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated @hapi/hoek@8.5.1: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated @hapi/joi@15.1.1: Switch to 'npm install joi'
npm WARN deprecated core-js@2.6.12: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.

added 1988 packages, and audited 1988 packages in 8s

126 packages are looking for funding
  run `npm fund` for details

3 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

This is what the audit shows:

# npm audit report

immer  <8.0.1
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1603
fix available via `npm audit fix --force`
Will install react-scripts@2.0.5, which is a breaking change
node_modules/immer
  react-dev-utils  >=6.0.6-next.9b4009d7
  Depends on vulnerable versions of immer
  node_modules/react-dev-utils
    react-scripts  >=2.0.6-next.9b4009d7
    Depends on vulnerable versions of react-dev-utils
    node_modules/react-scripts

3 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force
Scotch
  • 113
  • 1
  • 1
  • 13
  • I have the same Problem with react-scripts 4.0.3. Could you solve the problem? – Emlon Jun 24 '21 at 07:55
  • It seems like [the official advise](https://github.com/facebook/create-react-app/issues/11174) is to ignore it (not just this case, since it has a fix, but all cases of vulnerabilities in `react-script` dependencies. Normally I think ignoring security warnings is a terrible idea, but they make a good case in this ticket (and it's facebook saying it, not "some dude on the internet", so they probably thought about it). – Claude Dec 14 '21 at 12:14

2 Answers2

8

I fought over this issue for a few hours yesterday and this morning and found this thread which seems to be the cause:

https://github.com/facebook/create-react-app/issues/10411

As well as this proposed fix:

https://github.com/facebook/create-react-app/pull/10412

It looks like it's a dependency issue with immer, react-scripts, and react-dev-tools. They say they will try and push out an update this weekend so I would look forward to that sooner than later.

Dharman
  • 30,962
  • 25
  • 85
  • 135
Ilya Minarov
  • 89
  • 1
1

I think I had the same problem today. npm update react-dev-utils --depth 2 into the console helped me and resolved following:

High Prototype Pollution

Package immer

Dependency of react-scripts

Path react-scripts > react-dev-utils > immer

More info https://nodesecurity.io/advisories/1603

Peer
  • 189
  • 1
  • 8