Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS29 JUL
nanoid: custom generators can loop indefinitely when size is zero
fixed in 3.3.18
nanoid: non-secure generators can loop indefinitely with negative size
fixed in 3.3.16 · 5.1.16
24 JUL
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
fixed in 7.5.21
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
fixed in 8.5.18
23 JUL
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
fixed in 8.5.12
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
no fix yet
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
no fix yet
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
no fix yet
22 JUL
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
fixed in 3.1.6
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
fixed in 3.1.6
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
fixed in 3.1.6
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
fixed in 3.1.6
Dompdf: File existence oracle via font-face stylesheet declaration
fixed in 3.1.6
21 JUL
guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
fixed in 2.12.3
20 JUL
Guzzle: URI fragments disclosed in redirect Referer headers
fixed in 7.15.1
Guzzle: Host-only cookie scope is not preserved
fixed in 7.15.1
Guzzle: Unbounded response cookies risk denial of service
fixed in 7.15.1
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
fixed in 7.12.3
node-tar: Negative tar entry size causes infinite loop in archive replace
fixed in 7.5.18
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
fixed in 7.5.17
Guzzle: Proxy-Authorization headers can be sent to origin servers
fixed in 7.14.2
17 JUL
Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
fixed in 3.1.28
9 JUL
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
no fix yet
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
no fix yet
7 JUL
Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection
fixed in 5.3.5
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.