Skip to content

Security patches (stable/1.x) (major) - #3939

Open
renovate[bot] wants to merge 1 commit into
stable/1.xfrom
renovate/stable/1.x-major-security-patches
Open

Security patches (stable/1.x) (major)#3939
renovate[bot] wants to merge 1 commit into
stable/1.xfrom
renovate/stable/1.x-major-security-patches

Conversation

@renovate

@renovate renovate Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@faker-js/faker (source) ^9.9.0 → ^10.0.0 age confidence
deepmerge-ts ^7.1.5 → ^8.0.0 age confidence
react-router (source) ^6.30.4 → ^7.0.0 age confidence
zod (source) ^3.25.76 → ^4.0.0 age confidence

Faker: helpers.fake exploitable into arbritary code execution

CVE-2026-73231 / GHSA-qxc2-j82w-r537

More information

Details

Summary

faker.helpers.fake can be tricked into arbritary code execution.

Details

fakeEval.resolveProperty resolves properties on functions itself instead of resolving the nested function first.
This can be addressed by recursively calling resolveProperty instead of accessing the property after one iteration.

PoC

Go to https://fakerjs.dev/
Open Browser console and run

await enableFaker(); // or import faker
faker.rawDefinitions.test = (() => () => {}); // Any function that returns a function
faker.helpers.fake(`{{test.constructor(alert('PowerLevel: Eval'))}}`);
Impact

The Fake method claims:

It is also NOT possible to use any non-faker methods or plain javascript in such patterns.

Which is objectively false, since any global gets fully accessible in the fake string.

Severity

  • CVSS Score: 7.8 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

DeepmergeTS has stack exhaustion when merging recursive object graphs

CVE-2026-40345 / GHSA-ggr8-5vv4-36mx

More information

Details

Summary

deepmerge() and deepmergeInto() can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded.

Details

Record merging is implemented recursively. For each enumerable key, the library collects the values from every input object and immediately calls the same merge routine on that property.

There is no visited-object tracking, pair tracking, or cycle detection in that recursion. As a result, if two merged records both point back to themselves through the same key path, the merge logic keeps revisiting the same object pair forever.

This is reachable through the real public API:

  • deepmerge(...)
  • deepmergeCustom(...)(...)
  • deepmergeInto(target, ...)
  • deepmergeIntoCustom(...)(target, ...)

The issue only occurs when recursive object graphs are supplied. Plain JSON alone does not create this condition.

PoC
import { deepmerge, deepmergeInto } from "deepmerge-ts";

const left = {};
left.self = left;

const right = {};
right.self = right;

try {
  deepmerge(left, right);
} catch (error) {
  console.log(error.name, error.message);
  // Expected: the merge should reject or safely handle recursive input without exhausting the stack.
  // Vulnerable behavior: RangeError Maximum call stack size exceeded
}

const target = {};
target.self = target;

const source = {};
source.self = source;

try {
  deepmergeInto(target, source);
} catch (error) {
  console.log(error.name, error.message);
  // Expected: the merge should reject or safely handle recursive input without exhausting the stack.
  // Vulnerable behavior: RangeError Maximum call stack size exceeded
}
Impact

Applications that pass attacker-controlled recursive object graphs into these APIs can be forced into a synchronous crash path. In Node.js services, that can terminate request handling for the affected process or trigger repeated worker restarts until the malicious input is blocked.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

CVE-2026-53666 / GHSA-337j-9hxr-rhxg

More information

Details

If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code.

[!NOTE]
This does not impact your application if you are using Declarative Mode. This only impacts Framework Mode and Data Mode applications doing manual SSR/hydration

Severity

  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)

CVE-2026-53669 / GHSA-wrjc-x8rr-h8h6

More information

Details

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.

Severity

  • CVSS Score: 5.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Zod can exhaust memory while validating oversized constrained collections

CVE-2023-54404 / GHSA-mrhx-c7xc-m3w5

More information

Details

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

faker-js/faker (@​faker-js/faker)

v10.5.0

Compare Source

New Locales
Features
Bug Fixes

v10.4.0

Compare Source

New Locales
Features
Changed Locales
  • locale: filter and cleanup PersonEntryDefintions data (#​3266) (67defc8)
Bug Fixes
  • locales: correct typos and capitalization in es_MX street names (#​3737) (2b32c28)

v10.3.0

Compare Source

New Locales
Features
Changed Locales
Bug Fixes

v10.2.0

Compare Source

New Locales
Features
Bug Fixes

v10.1.0

Compare Source

New Locales
Bug Fixes

v10.0.0

Compare Source

New Locales
Features
  • locales: add animal vocabulary(bear, bird, cat, rabbit, pet_name) in Korean (#​3535) (0d2143c)
Changed Locales
RebeccaStevens/deepmerge-ts (deepmerge-ts)

v8.0.0

Compare Source

Bug Fixes
  • stop deepmergeInto from leak-mutating nested input containers (2cd7824)
Code Refactoring
  • rename mergeInfo system and align shorthand, add JSDoc examples (590ed9b)
Features
  • add circular reference support, maxDepth option, and hierarchy tracking (#​707) (3984927)
  • add deepmergeFastUnsafe and deepmergeIntoFastUnsafe entrypoints (#​708) (df9b11c)
  • support deep map value merging (ac4bf7a), closes #​705
Performance Improvements
  • add a dedicated fast path for merging 2 records (4dbcea7)
  • avoid array reallocation when no undefined values exist (99f2241), closes #​696
  • optimize array and set merging (8d435f9), closes #​698
  • optimize map merging and remove dead code (14e1604), closes #​702
  • optimize record key and type detection (fa85462), closes #​694
  • reduce benchmark sample count so the bench fits in 512MB heap (66635e3)
  • reduce type-level work and shortcut same-type merges (473a971)
  • speed up the mergeUnknowns hot path (95b2964), closes #​699
BREAKING CHANGES
  • deepmergeInto no longer leak-mutates input containers.
    Code that depended on inputs being merged into the target through alias
    must now pass copies explicitly. The documented 'update the target'
    behavior is preserved on the target itself.
    • DeepMergeMetaMetaData has been renamed to DeepMergeMergeInfo. Imports
      must be updated.
  • The MetaDataUpdater callback's metaMeta parameter is now mergeInfo.
    Implementations must update the parameter name accordingly.
  • The MM generic shorthand has been renamed to MI (e.g. in
    MetaDataUpdater<M, MI>).
  • The DeepMergeIntoFunctionUtils type has been renamed to DeepMergeIntoUtils.
  • Updates the internal calculation logic for mergeMaps and
    mergeMapsInto. Colliding keys will now be merged.

7.1.6 (2026-08-11)

Bug Fixes
  • preserve known keys when merging objects with index signatures (#​692) (e86cd8c)

7.1.5 (2025-02-23)

Bug Fixes
  • improve type merging of nested optional properties (#​530) (349fd14)

7.1.4 (2025-01-23)

Bug Fixes

7.1.3 (2024-10-08)

7.1.2 (2024-10-08)

Performance Improvements

7.1.1 (2024-10-04)

Performance Improvements
  • add explicit return type to speed up types (8e1ff6d)

v7.1.6

Compare Source

Bug Fixes
  • stop deepmergeInto from leak-mutating nested input containers (2cd7824)
Code Refactoring
  • rename mergeInfo system and align shorthand, add JSDoc examples (590ed9b)
Features
  • add circular reference support, maxDepth option, and hierarchy tracking (#​707) (3984927)
  • add deepmergeFastUnsafe and deepmergeIntoFastUnsafe entrypoints (#​708) (df9b11c)
  • support deep map value merging (ac4bf7a), closes #​705
Performance Improvements
  • add a dedicated fast path for merging 2 records (4dbcea7)
  • avoid array reallocation when no undefined values exist (99f2241), closes #​696
  • optimize array and set merging (8d435f9), closes #​698
  • optimize map merging and remove dead code (14e1604), closes #​702
  • optimize record key and type detection (fa85462), closes #​694
  • reduce benchmark sample count so the bench fits in 512MB heap (66635e3)
  • reduce type-level work and shortcut same-type merges (473a971)
  • speed up the mergeUnknowns hot path (95b2964), closes #​699
BREAKING CHANGES
  • deepmergeInto no longer leak-mutates input containers.
    Code that depended on inputs being merged into the target through alias
    must now pass copies explicitly. The documented 'update the target'
    behavior is preserved on the target itself.
    • DeepMergeMetaMetaData has been renamed to DeepMergeMergeInfo. Imports
      must be updated.
  • The MetaDataUpdater callback's metaMeta parameter is now mergeInfo.
    Implementations must update the parameter name accordingly.
  • The MM generic shorthand has been renamed to MI (e.g. in
    MetaDataUpdater<M, MI>).
  • The DeepMergeIntoFunctionUtils type has been renamed to DeepMergeIntoUtils.
  • Updates the internal calculation logic for mergeMaps and
    mergeMapsInto. Colliding keys will now be merged.

7.1.6 (2026-08-11)

Bug Fixes
  • preserve known keys when merging objects with index signatures (#​692) (e86cd8c)

7.1.5 (2025-02-23)

Bug Fixes
  • improve type merging of nested optional properties (#​530) (349fd14)

7.1.4 (2025-01-23)

Bug Fixes

7.1.3 (2024-10-08)

7.1.2 (2024-10-08)

Performance Improvements

7.1.1 (2024-10-04)

Performance Improvements
  • add explicit return type to speed up types (8e1ff6d)
remix-run/react-router (react-router)

v7.18.0

Compare Source

Patch Changes
  • Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#​15173)
  • Use the ServerRouter nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#​15170)
  • Use turbo-stream to serialize and deserialize Framework Mode hydration errors (#​15175)
  • Precompute route branch matchers to avoid recompiling route path regexes during matching (#​15186)
  • Use the constructed request URL host when validating action request origins. (#​15185)
  • Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows (#​15175)
  • Validate protocols in RSC render redirects (#​15177)
  • Consolidate url normalization logic and better handle mixed slashes (#​15176)

v7.17.0

Compare Source

Minor Changes
  • Ship a subset of the official documentation inside the react-router package (#​15121)
    • Markdown docs are now available in node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locally
    • Excludes auto-generated API docs (api/), community/ content, and tutorials (tutorials/)

v7.16.0

Compare Source

Minor Changes
  • Stabilize future.unstable_trailingSlashAwareDataRequests as future.v8_trailingSlashAwareDataRequests (#​15098)
Patch Changes

  • Disable manifest path when lazy route dicovery is disabled (#​15068)

  • Fix browser URL creation to use the configured history window instead of the global window. (#​15066)

    • Pass the history/router window through to createBrowserURLImpl so custom window contexts keep the correct URL origin.

  • Fix useNavigation() return type to preserve discriminated union across navigation states (#​15095)

  • Widen MetaDescriptor script:ld+json type from LdJsonObject to LdJsonObject | LdJsonObject[] to permit multiple JSON-LD schemas in a single <script type="application/ld+json"> tag emitted by <Meta /> (#​15082)

v7.15.1

Compare Source

Patch Changes
  • Update router to operate on fetcher Maps in an immutable manner to avoid delayed React renders from potentially reading an updated but not yet committed Map. This could result in brief flickers in some fetcher-driven optimistic UI scenarios. (#​15028)
  • Fix serverLoader() returning stale SSR data when a client navigation aborts pending hydration before the hydration clientLoader resolves (#​15022)
  • Fix RouterProvider onError callback not being called for synchronous initial loader errors in SPA mode (#​15039) (#​14942)
  • Memoize useFetchers to return a stable identity and only change if fetchers changed (#​15028)
  • Internal refactor to consolidate mutation request detection through shared utility (#​15033)
Unstable Changes

⚠️ Unstable features are not recommended for production use

  • Add a new unstable_useRouterState() hook that consolidates access to active and pending router states (RFC: #​12358) (#​15017)

    • Data/Framework/RSC only — throws when used without a data router

    • This should allow you to consolidate usages of the following hooks which will likely be deprecated and removed in a future major version

      • useLocation
      • useSearchParams
      • useParams
      • useMatches
      • useNavigationType
      • useNavigation
      let { active, pending } = unstable_useRouterState();

// Active is always populated with the current location
active.location; // replaces `useLocation()`
active.searchParams; // replaces `useSearchParams()[0]`
active.params; // replaces `useParams()`
active.matches; // replaces `useMatches()`
active.type; // replaces `useNavigationType()`

// Pending is only populated during a navigation
pending.location; // replaces `useNavigation().location`
pending.searchParams; // equivalent to `new URLSearchParams(useNavigation().search)`
pending.params; // Not directly accessible today
pending.matches; // Not directly accessible today
pending.type; // Not directly accessible today
pending.state; // replaces `useNavigation().state`
pending.formMethod; // replaces useNavigation().formMethod
pending.formAction; // replaces useNavigation().formAction
pending.formEncType; // replaces useNavigation().formEncType
pending.formData; // replaces useNavigation().formData
pending.json; // replaces useNavigation().json
pending.text; // replaces useNavigation().text

v7.15.0

Compare Source

Minor Changes
  • Stabilize unstable_defaultShouldRevalidate as defaultShouldRevalidate on <Link>, <Form>, useLinkClickHandler, useSubmit, `fetcher.

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Pull requests that update a dependency file renovate security labels Oct 23, 2026
@renovate
renovate Bot force-pushed the renovate/stable/1.x-major-security-patches branch from b3e83c5 to ee57d11 Compare October 23, 2026 23:29

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file renovate security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants