Skip to content

[Aikido] Fix 2 security issues in next, lodash-es#59

Open
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-22757431-wpmk
Open

[Aikido] Fix 2 security issues in next, lodash-es#59
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-22757431-wpmk

Conversation

@aikido-autofix
Copy link
Copy Markdown
Contributor

Upgrade Next.js and Lodash to fix DoS vulnerability in Server Components and prototype pollution in utility functions.

✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
GHSA-q4gf-8mx6-v5v3
HIGH
[next] A specially crafted HTTP request to App Router Server Function endpoints can trigger excessive CPU usage during deserialization, causing denial of service (DoS).
CVE-2025-13465
MEDIUM
[lodash-es] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants