[PR #2399] [MERGED] fix: security CVE-2026-23527 #2271

New issue

Closed

opened 2026-02-26 20:33:11 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 20:33:11 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/documenso/documenso/pull/2399
Author: @tedliang
Created: 1/20/2026
Status: ✅ Merged
Merged: 1/27/2026
Merged by: @Mythie

Base: main ← Head: fix/CVE-2026-23745

📝 Commits (3)

3f798b2 fix: security CVE-2026-23527
76d1358 Merge branch 'main' into fix/CVE-2026-23745
c98ce8a chore: upgrade packages

📊 Changes

4 files changed (+89 additions, -169 deletions)

View changed files

📝 package-lock.json (+84 -163)
📝 package.json (+2 -3)
📝 packages/prisma/package.json (+2 -2)
📝 packages/trpc/package.json (+1 -1)

📄 Description

Description

# npm audit report

h3  <=1.15.4
Severity: high
h3 v1 has Request Smuggling (TE.TE) issue - https://github.com/advisories/GHSA-mp2g-9vg9-f4cg
fix available via `npm audit fix --force`
Will install trpc-to-openapi@2.1.5, which is a breaking change
node_modules/h3
  trpc-to-openapi  >=2.2.0
  Depends on vulnerable versions of h3
  node_modules/trpc-to-openapi

tar  <=7.5.2
Severity: high
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - https://github.com/advisories/GHSA-8qq5-rm4j-mr97
No fix available
node_modules/tar
  inngest-cli  *
  Depends on vulnerable versions of tar
  node_modules/inngest-cli

4 high severity vulnerabilities

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

N/A

Changes Made

Downgrade trpc-to-openapi
Move inngest-cli to devDependencies

Testing Performed

Tested on Chrome

Checklist

I have tested these changes locally and they work as expected.
I have added/updated tests that prove the effectiveness of these changes.
I have updated the documentation to reflect these changes, if applicable.
I have followed the project's coding style guidelines.
I have addressed the code review feedback from the previous submission, if applicable.

Additional Notes

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/documenso/documenso/pull/2399 **Author:** [@tedliang](https://github.com/tedliang) **Created:** 1/20/2026 **Status:** ✅ Merged **Merged:** 1/27/2026 **Merged by:** [@Mythie](https://github.com/Mythie) **Base:** `main` ← **Head:** `fix/CVE-2026-23745` --- ### 📝 Commits (3) - [`3f798b2`](https://github.com/documenso/documenso/commit/3f798b2df978e72bd6db7685d4a917de65104c8e) fix: security CVE-2026-23527 - [`76d1358`](https://github.com/documenso/documenso/commit/76d1358a0b077af83dcfe103f1c73e55767730c4) Merge branch 'main' into fix/CVE-2026-23745 - [`c98ce8a`](https://github.com/documenso/documenso/commit/c98ce8a6f110cbecd37af3e7a0927f51e3340d82) chore: upgrade packages ### 📊 Changes **4 files changed** (+89 additions, -169 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+84 -163) 📝 `package.json` (+2 -3) 📝 `packages/prisma/package.json` (+2 -2) 📝 `packages/trpc/package.json` (+1 -1) </details> ### 📄 Description ## Description   ``` # npm audit report h3 <=1.15.4 Severity: high h3 v1 has Request Smuggling (TE.TE) issue - https://github.com/advisories/GHSA-mp2g-9vg9-f4cg fix available via `npm audit fix --force` Will install trpc-to-openapi@2.1.5, which is a breaking change node_modules/h3 trpc-to-openapi >=2.2.0 Depends on vulnerable versions of h3 node_modules/trpc-to-openapi tar <=7.5.2 Severity: high node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - https://github.com/advisories/GHSA-8qq5-rm4j-mr97 No fix available node_modules/tar inngest-cli * Depends on vulnerable versions of tar node_modules/inngest-cli 4 high severity vulnerabilities To address all issues possible (including breaking changes), run: npm audit fix --force Some issues need review, and may require choosing a different dependency. ``` ## Related Issue   N/A ## Changes Made   - Downgrade trpc-to-openapi - Move inngest-cli to devDependencies ## Testing Performed   - Tested on Chrome ## Checklist   - [X] I have tested these changes locally and they work as expected. - [X] I have added/updated tests that prove the effectiveness of these changes. - [X] I have updated the documentation to reflect these changes, if applicable. - [X] I have followed the project's coding style guidelines. - [X] I have addressed the code review feedback from the previous submission, if applicable. ## Additional Notes   --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-02-26 20:33:11 +03:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/documenso#2271

No description provided.

Rows
Columns