Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#48451] - [5.4] NPM updates 2026-09-12

NPM Resource Changed PR-5.4-dev Pending

User tests: Successful: Unsuccessful:

avatar richard67
richard67
12 Sep 2026

Pull Request resolves # .

  • I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

This pull request (PR) fixes 1 low, 3 moderate and 9 high severity security vulnerabilities in NPM development dependencies reported by npm audit by using npm audit fix.

The update includes also the browserlist dependencies so that is not reported anymore by npm to be outdated.

The remaining moderate severity issues for the extract-zip, qs and uuid dependencies might be fixable when an npm audit fix is done in the repo of the joomla-cypress. But this will very likely not be ready before 5.4.8-rc1 on Tuesday and should be checked later.

For 6.1-dev it does not need an equivalent PR as the updates have been made there already with PR #48433 .

Testing Instructions

It needs a development environment with a git clone, composer and npm.

  1. If not done before, run composer install and npm ci.
  2. Run npm audit to check all dependencies and check the result.

Actual result BEFORE applying this Pull Request

# npm audit report

@humanfs/node  <0.16.8
Severity: moderate
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree - https://github.com/advisories/GHSA-p498-v437-472g
fix available via `npm audit fix`
node_modules/@humanfs/node

browserslist  <=4.28.6
Severity: high
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM - https://github.com/advisories/GHSA-c83g-rgw3-j3cx
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) - https://github.com/advisories/GHSA-73wf-gq98-2v4g
fix available via `npm audit fix`
node_modules/browserslist

colord  <2.9.4
Severity: moderate
Colord: Slow rejection of oversized malformed color strings - https://github.com/advisories/GHSA-2wm5-q62r-hmrv
fix available via `npm audit fix`
node_modules/colord

deepmerge-ts  <8.0.0
Severity: high
DeepmergeTS has stack exhaustion when merging recursive object graphs - https://github.com/advisories/GHSA-ggr8-5vv4-36mx
fix available via `npm audit fix`
node_modules/deepmerge-ts
  html-to-text  10.0.0
  Depends on vulnerable versions of deepmerge-ts
  node_modules/html-to-text
    mailparser  2.3.1 - 3.9.19
    Depends on vulnerable versions of html-to-text
    Depends on vulnerable versions of nodemailer
    node_modules/mailparser

extract-zip  *
Severity: high
extract-zip unvalidated symlink path traversal - https://github.com/advisories/GHSA-jmr9-qjv8-65gv
extract-zip allows arbitrary file writes through symlink archive entries - https://github.com/advisories/GHSA-7pqw-9j4j-h8q3
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/extract-zip
  cypress  0.9.1 - 15.15.0
  Depends on vulnerable versions of @cypress/request
  Depends on vulnerable versions of extract-zip
  node_modules/joomla-cypress/node_modules/cypress
    joomla-cypress  1.1.0 - 1.3.1
    Depends on vulnerable versions of cypress
    node_modules/joomla-cypress

fast-uri  3.0.0 - 3.1.5
Severity: high
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - https://github.com/advisories/GHSA-5jgf-p345-68v8
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization - https://github.com/advisories/GHSA-f65p-4m7j-42xc
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding - https://github.com/advisories/GHSA-fph4-wmhf-6fwf
fast-uri vulnerable to host confusion via percent-encoded scheme normalization - https://github.com/advisories/GHSA-jqff-g426-hqxp
fix available via `npm audit fix`
node_modules/fast-uri

js-yaml  4.0.0 - 4.3.1
Severity: high
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources - https://github.com/advisories/GHSA-2883-xcg3-v3hh
fix available via `npm audit fix`
node_modules/js-yaml

mysql2  <=3.23.0
Severity: high
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials - https://github.com/advisories/GHSA-3f6p-5ww8-9rcr
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS - https://github.com/advisories/GHSA-rgwj-5xj2-c3m3
fix available via `npm audit fix`
node_modules/mysql2

nanoid  <3.3.18
Severity: high
nanoid: custom generators can loop indefinitely when size is zero - https://github.com/advisories/GHSA-2v37-7h3g-55p8
fix available via `npm audit fix`
node_modules/nanoid

nodemailer  <=9.1.0
Severity: high
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature - https://github.com/advisories/GHSA-8m3c-c648-2xjj
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain - https://github.com/advisories/GHSA-wmmp-3585-3rmp
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list - https://github.com/advisories/GHSA-2x7j-588g-ccc2
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain - https://github.com/advisories/GHSA-cc9r-2j5m-2m83
fix available via `npm audit fix`
node_modules/mailparser/node_modules/nodemailer
node_modules/nodemailer
  smtp-server  2.0.0 - 3.19.5
  Depends on vulnerable versions of nodemailer
  node_modules/smtp-server

postcss-selector-parser  6.1.0 - 6.1.2 || 7.1.0 - 7.1.2
postcss-selector-parser allows denial of service through uncontrolled AST recursion - https://github.com/advisories/GHSA-w9m9-85wc-3x92
postcss-selector-parser allows denial of service through uncontrolled AST recursion - https://github.com/advisories/GHSA-w9m9-85wc-3x92
fix available via `npm audit fix`
node_modules/eslint-plugin-vue/node_modules/postcss-selector-parser
node_modules/postcss-selector-parser

qs  2.2.5 - 6.15.3
Severity: moderate
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
qs array-limit bypass via bracket-key comma parsing - https://github.com/advisories/GHSA-x5fp-wj9c-mxmx
qs: Denial of Service via Attacker Controlled isBuffer - https://github.com/advisories/GHSA-4mjr-xmp4-gh2g
fix available via `npm audit fix`
node_modules/cypress/node_modules/qs
node_modules/qs

tinymce  <=7.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - https://github.com/advisories/GHSA-mh5m-5hw4-5c69
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - https://github.com/advisories/GHSA-vg35-5wq7-3x7w
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - https://github.com/advisories/GHSA-q742-qvgc-gc2f
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - https://github.com/advisories/GHSA-v98h-vmpc-fpqv
fix available via `npm audit fix --force`
Will install tinymce@8.9.1, which is a breaking change
node_modules/tinymce

uuid  <11.1.1
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/uuid
  @cypress/request  <=3.0.10
  Depends on vulnerable versions of uuid
  node_modules/@cypress/request

20 vulnerabilities (1 low, 6 moderate, 13 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Expected result AFTER applying this Pull Request

# npm audit report

extract-zip  *
Severity: high
extract-zip unvalidated symlink path traversal - https://github.com/advisories/GHSA-jmr9-qjv8-65gv
extract-zip allows arbitrary file writes through symlink archive entries - https://github.com/advisories/GHSA-7pqw-9j4j-h8q3
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/extract-zip
  cypress  0.9.1 - 15.15.0
  Depends on vulnerable versions of @cypress/request
  Depends on vulnerable versions of extract-zip
  node_modules/joomla-cypress/node_modules/cypress
    joomla-cypress  1.1.0 - 1.3.1
    Depends on vulnerable versions of cypress
    node_modules/joomla-cypress

qs  2.2.5 - 6.15.3
Severity: moderate
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
qs array-limit bypass via bracket-key comma parsing - https://github.com/advisories/GHSA-x5fp-wj9c-mxmx
qs: Denial of Service via Attacker Controlled isBuffer - https://github.com/advisories/GHSA-4mjr-xmp4-gh2g
fix available via `npm audit fix`
node_modules/qs

tinymce  <=7.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - https://github.com/advisories/GHSA-mh5m-5hw4-5c69
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - https://github.com/advisories/GHSA-vg35-5wq7-3x7w
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - https://github.com/advisories/GHSA-q742-qvgc-gc2f
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - https://github.com/advisories/GHSA-v98h-vmpc-fpqv
fix available via `npm audit fix --force`
Will install tinymce@8.9.1, which is a breaking change
node_modules/tinymce

uuid  <11.1.1
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/uuid
  @cypress/request  <=3.0.10
  Depends on vulnerable versions of uuid
  node_modules/@cypress/request

7 vulnerabilities (3 moderate, 4 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Link to documentations

Please select:

  • Documentation link for guide.joomla.org:

  • No documentation changes for guide.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar richard67 richard67 - open - 12 Sep 2026
avatar richard67 richard67 - change - 12 Sep 2026
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 12 Sep 2026
Category ⇒ NPM Change
avatar richard67 richard67 - change - 12 Sep 2026
Title
…
[5.4] NPM updates 2026-09-11
[5.4] NPM updates 2026-09-12
avatar richard67 richard67 - edited - 12 Sep 2026
avatar brianteeman brianteeman - test_item - 12 Sep 2026 - Tested successfully
avatar brianteeman
brianteeman - comment - 12 Sep 2026

I have tested this item ✅ successfully on 1fe9788

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48451.

avatar brianteeman
brianteeman - comment - 12 Sep 2026

I have tested this item ✅ successfully on 1fe9788

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48451.

avatar muhme muhme - change - 13 Sep 2026
Labels Added: NPM Resource Changed PR-5.4-dev
avatar muhme muhme - change - 13 Sep 2026
Status Pending ⇒ Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 ⇒ 2026-09-13 06:28:05
Closed_By ⇒ muhme
avatar muhme muhme - close - 13 Sep 2026
avatar muhme muhme - merge - 13 Sep 2026
avatar muhme
muhme - comment - 13 Sep 2026

Thank you very much @richard67 for your contribution. Thank you @brianteeman for testing.

Add a Comment

Login with GitHub to post a comment