NPM Audit Issue with dns-packet

user_2533578 0
Viewed 960

Can some please explain how to fix the following (npm audit):

dns-packet  <5.2.2
Severity: high
Memory Exposure - https://npmjs.com/advisories/1745
fix available via `npm audit fix --force`
Will install @angular-devkit/build-angular@12.0.1, which is a breaking change
node_modules/bonjour/node_modules/dns-packet
  multicast-dns  6.0.0 - 7.2.2
  Depends on vulnerable versions of dns-packet
  node_modules/bonjour/node_modules/multicast-dns
    bonjour  >=3.3.1
    Depends on vulnerable versions of multicast-dns
    node_modules/bonjour
      webpack-dev-server  >=2.5.0
      Depends on vulnerable versions of bonjour
      node_modules/webpack-dev-server
        @angular-devkit/build-angular  *
        Depends on vulnerable versions of autoprefixer
        Depends on vulnerable versions of css-loader
        Depends on vulnerable versions of cssnano
        Depends on vulnerable versions of postcss
        Depends on vulnerable versions of resolve-url-loader
        Depends on vulnerable versions of webpack-dev-server
        node_modules/@angular-devkit/build-angular

As far as I can see the dns-packet has been patched along with the multicast-dns. So I updated these.

my package.json:

"devDependencies": {
    ....
    "multicast-dns": "^7.2.3",
    ....
  },

However after updating these I still get the audit high error.

Can anyone help?

npm angular
3 Answers

You should check your package-lock.json if dns-packet was indeed updated to 5.2.2 or a higher version to fix the Memory Exposure vulnerability.

You can add the least required version to resolutions in package.json and run npx npm-force-resolutions before npm install:

"resolutions": {
  ...
  "dns-packet": ">=5.2.2",
  ...
}
user_78083530

Just remove all dependencies in package-lock.json in which dns-packet < 5.2.3 is involved. Then run npm install.

user_160306610

What worked for me;

"resolutions": {
  "multicast-dns": "7.2.3"
}
user_125443910
Related