awslabs / awslabs/aws-crt-nodejs

Axios dependency contains known security vulnerabilities (GHSA-43fc-jf86-j433, GHSA-3p68-rc4w-qgx5, GHSA-fvcv-3m26-pcqx)

Open Beginner friendly
#715 0 comments 0 reactions 0 assignees View on GitHub
bug needs-triage
Dominant language
TypeScript
Stars
43
Forks
32
Avg merge
1d 17h
Merged PRs (30d)
1

Description

### Describe the bug

The current axios dependency (`^1.12.2`, resolved to `1.12.2`) contains three known security vulnerabilities:

| Advisory | Severity | Description |
|---|---|---|
| [GHSA-43fc-jf86-j433](https://github.com/advisories/GHSA-43fc-jf86-j433) | High (CVSS 7.5) | Denial of Service via `__proto__` key in `mergeConfig` — affects `>=1.0.0 <=1.13.4` |
| [GHSA-3p68-rc4w-qgx5](https://github.com/advisories/GHSA-3p68-rc4w-qgx5) | Moderate (CVSS 4.8) | `NO_PROXY` hostname normalization bypass leading to SSRF — affects `>=1.0.0 <1.15.0` |
| [GHSA-fvcv-3m26-pcqx](https://github.com/advisories/GHSA-fvcv-3m26-pcqx) | Moderate (CVSS 4.8) | Unrestricted cloud metadata exfiltration via header injection chain — affects `>=1.0.0 <1.15.0` |

Since `aws-crt-nodejs` is a transitive dependency of `aws-sdk` and `aws-sdk-v3`, these vulnerabilities are inherited by all downstream consumers. This is also related to #607.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Expected Behavior

The `axios` dependency should be pinned to a version that has no known security vulnerabilities (`>=1.15.1`).

### Current Behavior

Running `npm audit` on a project that depends on `aws-crt-nodejs` reports:

```
axios >=1.0.0
Severity: high/moderate
- Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
- Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
- Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
```

### Reproduction Steps

```bash
git clone https://github.com/awslabs/aws-crt-nodejs.git
cd aws-crt-nodejs
npm install --ignore-scripts
npm audit
```

### Possible Solution

Update the `axios` version in both `dependencies` and `overrides` in `package.json` from `^1.12.2` to `^1.15.1`, which is the first version that resolves all three vulnerabilities.

### Additional Information/Context

- `npm audit` confirms no axios vulnerabilities after updating to `1.15.1`.
- A fix for this is ready as a pull request.
- Long-term, issue #607 proposes replacing axios entirely with built-in Node.js alternatives.

### aws-crt-nodejs version used

1.21.0 (latest release)

### nodejs version used

v20.9.0

### Operating System and version

Ubuntu 20.04.5 LTS

Contributor guide

Open the contributing guide

Research direction

Update the axios version in both dependencies and overrides in package.json, changing ^1.12.2 to ^1.15.1. Start by running npm install --ignore-scripts and npm audit as shown in the reproduction steps; done means npm audit no longer reports the three listed axios vulnerabilities.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, typescript
Domain
security
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
75/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.