Advisories
npm security advisories.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS5 MAR
25 FEB
19 FEB
18 FEB
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
fixed in 7.5.8
28 JAN
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
fixed in 7.5.7
21 JAN
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
fixed in 4.17.23
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
fixed in 4.17.23
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
no fix yet
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
fixed in 4.17.23
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
fixed in 7.5.4
16 JAN
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
fixed in 7.5.3
20 OCT 2025
vite allows server.fs.deny bypass via backslash on Windows
fixed in 7.0.8 · 7.1.11
9 SEP 2025
Vite middleware may serve files starting with the same name with the public directory
fixed in 7.0.7 · 7.1.5
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.