Problem Description
The api service has 16 open Dependabot security alerts across 8 packages, including 1 critical, 7 high, and 8 moderate/low severity vulnerabilities.
Impact
All HTTP request processing, email delivery, file upload, validation, and shell command execution paths in the API are affected. Attackers could exploit these to cause denial of service, inject arbitrary HTTP headers/emails, bypass file access controls, leak information, or execute shell commands.
Affected Packages
Steps to Reproduce
- Deploy the
api service with current lockfile
- Run
npm audit to confirm vulnerabilities
- Exploit paths vary per CVE — see individual advisory links in the GitHub security tab
Expected Behavior
All dependencies should be at versions confirmed safe by their respective security advisories.
Actual Behavior
16 open alerts exist. Critical shell-quote vulnerability (CVE-2026-9277) allows shell injection via unescaped newlines in object .op values. Multiple high-severity issues enable DoS, header injection, and access control bypasses.
Environment
- Service: fom-api
- Language: Node.js ^24.1.0
- Environment: all (dev / test / prod)
Additional Context
This issue tracks remediation for the api dependency group. Each fix follows advisory-recommended versions. Fixes will be applied per package via direct version bumps, parent upgrades, or npm audit fix as appropriate.
Problem Description
The
apiservice has 16 open Dependabot security alerts across 8 packages, including 1 critical, 7 high, and 8 moderate/low severity vulnerabilities.Impact
All HTTP request processing, email delivery, file upload, validation, and shell command execution paths in the API are affected. Attackers could exploit these to cause denial of service, inject arbitrary HTTP headers/emails, bypass file access controls, leak information, or execute shell commands.
Affected Packages
Steps to Reproduce
apiservice with current lockfilenpm auditto confirm vulnerabilitiesExpected Behavior
All dependencies should be at versions confirmed safe by their respective security advisories.
Actual Behavior
16 open alerts exist. Critical shell-quote vulnerability (CVE-2026-9277) allows shell injection via unescaped newlines in object
.opvalues. Multiple high-severity issues enable DoS, header injection, and access control bypasses.Environment
Additional Context
This issue tracks remediation for the
apidependency group. Each fix follows advisory-recommended versions. Fixes will be applied per package via direct version bumps, parent upgrades, or npm audit fix as appropriate.