Unresolved transitive vulnerabilities in forest-express@10.9.0 — patch timeline?

Help me!
1

Feature(s) impacted

Dependency security — forest-express and forest-ip-utils ship transitive dependencies with known CVEs that cannot be patched by downstream consumers without breaking the packages at runtime.

Observed behavior

Running npm audit --omit=dev against a project using forest-express@10.9.0 (current latest) reports the following unresolvable vulnerabilities:

1. uuid@3.3.3 — GHSA-w5hq-g745-h8pq (moderate)
forest-express/dist/serializers/stat.js and dist/integrations/mixpanel/serializers/mixpanel-events.js both call require('uuid/v1') — a subpath export that was removed in uuid@8. Because this file is re-exported unconditionally from dist/index.js at module load time, forcing uuid to the patched range (>=11.1.1) via npm overrides causes a MODULE_NOT_FOUND crash on server startup.

2. ip-address@5.9.4 — GHSA-v2v4-37r5-5v8g (moderate)
forest-ip-utils@1.0.1 (a direct dependency of forest-express) declares ip-address@^5.8.9. The patched version is >=10.1.1, which has an incompatible API with 5.x. Overriding ip-address to 10.x breaks forest-ip-utils at runtime.

Expected behavior

A release of forest-express that either:

  • Updates uuid to >=8.0.0 and replaces the require('uuid/v1') subpath calls with the modern named export (const { v1: uuidv1 } = require('uuid')), and
  • Updates forest-ip-utils to a version that declares a compatible range for the patched ip-address (>=10.1.1).

Failure Logs

node_modules/forest-express/dist/serializers/stat.js:4:     var uuidV1 = require('uuid/v1');
node_modules/forest-express/dist/integrations/mixpanel/serializers/mixpanel-events.js:4:     var uuidV1 = require('uuid/v1');
node_modules/forest-express/dist/index.js:475:     exports.StatSerializer = require('./serializers/stat');

node_modules/forest-ip-utils/package.json → "ip-address": "^5.8.9"

npm audit output (prod only):

ip-address  <=10.1.0  (moderate)
  forest-ip-utils  *
    forest-express  >=0.1.33

uuid  <11.1.1  (moderate)
  node_modules/forest-express/node_modules/uuid

Context

  • Project name: Internal microservice (Carpintero)
  • Team name: Finicity - Connect Services
  • Environment name: Production (Node.js)
  • Database type: MySQL (Sequelize)
  • Recent changes made on your end if any: Attempted to resolve audit findings via npm overrides; all other transitive vulnerabilities in the dependency tree were resolved except those originating from forest-express and forest-ip-utils
2

Hi @Andrew_Prior :waving_hand: we are on it.
I’will keep you posted.

3

Thank you for the response. Please let me know when details are available.

4

Hey @Andrew_Prior the fix has been released.
Please upgrade forest-express-sequelize to 9.6.7.
Let me know :folded_hands: