Summary
npm audit against v1/main reports 7 advisories beyond the js-yaml one in #2072. This issue covers the five that are present in the production dependency tree, plus two dev-only stragglers needed to actually reach a clean audit.
Triage conclusion up front: only one of the five is meaningfully reachable. The other four are installed-but-unexercised. None of them individually forces a v1 release; the value here is a clean npm audit so that a future genuine advisory isn't lost in the noise.
Reachable
ip-address <=10.3.0 (high)
server/src/index.ts:43 builds sandboxRateLimiter from express-rate-limit, which calls new Address6(ip) and new Address6(\${ip}/${ipv6Subnet}`) for IPv6 subnet keying (express-rate-limit/dist/index.mjs:3,6,9`). Two of the three advisories are precisely about CIDR-suffix and IPv4-mapped/NAT64 misclassification.
Realistic impact in this codebase is a rate-limit key bypass on /sandbox, not the SSRF the advisory titles imply: req.ip derives from the socket under default trust-proxy settings and the proxy binds localhost. Worth fixing, modest severity in context.
Present in the production tree but not reachable
| Package |
Advisory |
Why it doesn't bite here |
hono <=4.12.33 (mod) |
ReDoS in CORS middleware; memo() SSR cross-user disclosure; proxy helper Connection headers; language middleware DoS |
All four are in middleware. The inspector has no direct hono usage — it arrives only beneath @hono/node-server, and none of that middleware is wired up. |
@hono/node-server <1.19.15 (mod) |
Path traversal in serve-static on Windows via encoded backslash (%5C) |
The SDK's server/streamableHttp.js imports only getRequestListener. serve-static is never touched. |
fast-uri 3.0.0 - 3.1.4 (high) |
Host confusion via backslash authority delimiter |
Reached via ajv under the SDK for format: "uri" schema checks. Exploitation needs a validated URI to then be trusted for a host decision; no such path exists here. |
brace-expansion <=1.1.17 (high) |
DoS via unbounded expansion / intermediate arrays |
Reached via serve-handler -> minimatch@3.1.5 in client/bin/client.js:6. At serve-handler/src/index.js:59 the call is minimatch(resolvedPath, slashed): the attacker controls the path, but brace-expansion expands the pattern, which comes from config. Not attacker-controlled. |
Dev-only
nanoid <3.3.18 and postcss <=8.5.22 both return empty from npm ls --omit=dev (vite/tailwind build chain). Included only so the audit actually reaches zero.
Fix
Every patched release exists within the current major line, so no major upgrades are required:
| Package |
From |
To |
ip-address |
10.2.0 |
10.5.0 |
hono |
4.12.30 |
4.13.3 |
@hono/node-server |
1.19.14 |
1.19.17 |
fast-uri |
3.1.3 |
3.1.5 |
brace-expansion |
1.1.16 / 5.0.7 |
1.1.18 / 5.0.9 |
nanoid |
3.3.16 |
3.3.18 |
postcss |
8.5.19 |
8.5.26 |
@hono/node-server is deliberately held at 1.19.17, not the current 2.1.1 — a major bump has no place on a deprecated branch.
As with #2072, the lock entries are patched in place rather than re-resolved, keeping the diff to the affected packages only.
Verification
npm audit reports 0 vulnerabilities. Build, lint, and all suites pass (539 client + 37 server + 85 CLI). The app starts, serves the client through serve-handler (the brace-expansion path), gates proxy auth correctly, and completes a full MCP tools/list + tools/call round-trip through the CLI. The rate limiter — the ip-address consumer — was exercised directly and observed decrementing (X-RateLimit-Remaining: 89 of 100).
Summary
npm auditagainstv1/mainreports 7 advisories beyond the js-yaml one in #2072. This issue covers the five that are present in the production dependency tree, plus two dev-only stragglers needed to actually reach a clean audit.Triage conclusion up front: only one of the five is meaningfully reachable. The other four are installed-but-unexercised. None of them individually forces a v1 release; the value here is a clean
npm auditso that a future genuine advisory isn't lost in the noise.Reachable
ip-address<=10.3.0 (high)server/src/index.ts:43buildssandboxRateLimiterfromexpress-rate-limit, which callsnew Address6(ip)andnew Address6(\${ip}/${ipv6Subnet}`)for IPv6 subnet keying (express-rate-limit/dist/index.mjs:3,6,9`). Two of the three advisories are precisely about CIDR-suffix and IPv4-mapped/NAT64 misclassification.Realistic impact in this codebase is a rate-limit key bypass on
/sandbox, not the SSRF the advisory titles imply:req.ipderives from the socket under default trust-proxy settings and the proxy binds localhost. Worth fixing, modest severity in context.Present in the production tree but not reachable
hono<=4.12.33 (mod)memo()SSR cross-user disclosure; proxy helperConnectionheaders; language middleware DoS@hono/node-server, and none of that middleware is wired up.@hono/node-server<1.19.15 (mod)serve-staticon Windows via encoded backslash (%5C)server/streamableHttp.jsimports onlygetRequestListener.serve-staticis never touched.fast-uri3.0.0 - 3.1.4 (high)ajvunder the SDK forformat: "uri"schema checks. Exploitation needs a validated URI to then be trusted for a host decision; no such path exists here.brace-expansion<=1.1.17 (high)serve-handler->minimatch@3.1.5inclient/bin/client.js:6. Atserve-handler/src/index.js:59the call isminimatch(resolvedPath, slashed): the attacker controls the path, but brace-expansion expands the pattern, which comes from config. Not attacker-controlled.Dev-only
nanoid<3.3.18 andpostcss<=8.5.22 both return empty fromnpm ls --omit=dev(vite/tailwind build chain). Included only so the audit actually reaches zero.Fix
Every patched release exists within the current major line, so no major upgrades are required:
ip-addresshono@hono/node-serverfast-uribrace-expansionnanoidpostcssAs with #2072, the lock entries are patched in place rather than re-resolved, keeping the diff to the affected packages only.
Verification
npm auditreports 0 vulnerabilities. Build, lint, and all suites pass (539 client + 37 server + 85 CLI). The app starts, serves the client throughserve-handler(the brace-expansion path), gates proxy auth correctly, and completes a full MCPtools/list+tools/callround-trip through the CLI. The rate limiter — theip-addressconsumer — was exercised directly and observed decrementing (X-RateLimit-Remaining: 89of 100).