Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25

• Laravel Mix Version: 6.0.43 (npm list --depth=0)
• Node Version (node -v): 16.14.2
• NPM Version (npm -v): 8.5.0
• OS: Ubuntu 20.04.4 LTS (Focal Fossa)

Description:

When running npm audit warnings are given about async in the upstream webpack-dev-server and portfinder.

Steps To Reproduce:

Run npm audit.

# npm audit report

async  <3.2.2
Severity: high
Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25
No fix available
node_modules/async
  portfinder  0.1.0 || >=0.4.0
  Depends on vulnerable versions of async
  node_modules/portfinder
    webpack-dev-server  >=2.0.0-beta
    Depends on vulnerable versions of portfinder
    node_modules/webpack-dev-server
      laravel-mix  *
      Depends on vulnerable versions of webpack-dev-server
      node_modules/laravel-mix

4 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

[thecrypticace]

Given that a fix has been released I’m closing this. Running npm upgrade will upgrade async (it upgrades all dependencies in your tree — not just direct dependencies). All we can do now is wait for npm’s advisory database to be updated to reflect that 2.6.4 is not vulnerable.

[GiorgiaBoniniEstar]

@GiorgiaBoniniEstar my understanding was that the 3.x version introduced breaking changes so folks are better sticking with the 2.x branch

yep, the version is only an example and this is absolutely temporary, I’ve just changed from “>3.2.2” to “”>=2.6.4"" and it works like a charm