Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25

[AlexWinder]

• Laravel Mix Version: 6.0.43 (npm list --depth=0)
• Node Version (node -v): 16.14.2
• NPM Version (npm -v): 8.5.0
• OS: Ubuntu 20.04.4 LTS (Focal Fossa)

Description:

When running npm audit warnings are given about async in the upstream webpack-dev-server and portfinder.

Steps To Reproduce:

Run npm audit.

# npm audit report

async  <3.2.2
Severity: high
Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25
No fix available
node_modules/async
  portfinder  0.1.0 || >=0.4.0
  Depends on vulnerable versions of async
  node_modules/portfinder
    webpack-dev-server  >=2.0.0-beta
    Depends on vulnerable versions of portfinder
    node_modules/webpack-dev-server
      laravel-mix  *
      Depends on vulnerable versions of webpack-dev-server
      node_modules/laravel-mix

4 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

[thecrypticace]

The possible fix for this is being tracked here: caolan/async#1828

Not on us but I'll leave this open for the time being

[AlexWinder]

Thanks @thecrypticace

[arborrow]

Looks like the patch for the security issue was backported and now available in 2.6.4. So while the npm audit is still showing it as vulnerable, 2.6.4 is patched and we can probably close this issue.

[inspiraller]

Any temporary solution to this?

[GiorgiaBoniniEstar]

Any temporary solution to this?

I don't know if it can help but I've modified temporarily package.json in my Laravel Project, in this way:

"overrides": {
        "webpack-dev-server": {
            "portfinder": {
                "async": ">3.2.2"
            }
        }
    }

(not mine temporary solution!)

[arborrow]

@inspiraller just run an upgrade and you will get the updated and patched 2.6.4 version

[arborrow]

@GiorgiaBoniniEstar my understanding was that the 3.x version introduced breaking changes so folks are better sticking with the 2.x branch

[inspiraller]

@arborrow - I'm already using "webpack-dev-server": "4.8.1" - latest version

[GiorgiaBoniniEstar]

@GiorgiaBoniniEstar my understanding was that the 3.x version introduced breaking changes so folks are better sticking with the 2.x branch

yep, the version is only an example and this is absolutely temporary, I've just changed from ">3.2.2" to "">=2.6.4"" and it works like a charm

[thecrypticace]

Given that a fix has been released I'm closing this. Running npm upgrade will upgrade async (it upgrades all dependencies in your tree — not just direct dependencies). All we can do now is wait for npm's advisory database to be updated to reflect that 2.6.4 is not vulnerable.