Closed marshmn closed 2 months ago
This is the CVE: https://nvd.nist.gov/vuln/detail/CVE-2024-29415
Hi. Thanks for the report. There's no current workaround here. No patch has yet been released for ip
. The only usage of the ip
library in the client is for the remote address strategy, to see if the req.ip
matches what has been defined in properties; so reading the CVE it doesn't seem like we would run into a problem here. But I see that failing the scan can be a dealbreaker, so we'll pay attention and release an upgrade as soon as the ip
library releases a patch/fix.
@chriswk ip
is poorly maintained, so there may be better options like mentioned in https://github.com/storybookjs/storybook/issues/26014#issuecomment-1942959058
Please release this as soon as possible, as it resolves auditing issues.
Describe the bug
Since yesterday, the NPM audit of my application (which uses unleash-client) has been failing due to what looks to be a vulnerability in the
ip
dependency:It looks like the dependency will need updating.
Steps to reproduce the bug
No response
Expected behavior
No response
Logs, error output, etc.
No response
Screenshots
No response
Additional context
No response
Unleash version
No response
Subscription type
None
Hosting type
None
SDK information (language and version)
No response