Npm audit fails with recent node-red

General
1

When running npm audit with recent node-red, I got the following error:

uuid  <14.0.0
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix --force`
Will install node-red@1.3.7, which is a breaking change
node_modules/uuid
  @node-red/nodes  2.0.0-beta.1 - 5.0.0-beta.5
  Depends on vulnerable versions of uuid
  node_modules/@node-red/nodes
    node-red  2.0.0-beta.1 - 5.0.0-beta.5
    Depends on vulnerable versions of @node-red/nodes
    node_modules/node-red

The error seems to be related to old UUID formats. Are these formats used by node-red?

2

You can simply do npm ls uuid to find out what requires that library.

>npm ls uuid
node-red-master@5.0.0-beta.0 D:\src\nrnext
`-- (empty)

Use npm -g ls uuid if you have a standard node-red install.

Running from my test userDir folder:

npm ls uuid
node-red-userdir@3.0.2 D:\src\nrnext\data
`-- node-red-contrib-uibuilder@7.6.2 -> .\..\..\node-red-contrib-uibuilder
  `-- mermaid@11.14.0
    `-- uuid@11.1.0

Which is a dependency on the uibuilder documentation I think.

However, from that same location:

>npm audit
found 0 vulnerabilities

Which suggests that uuid <14.0.0 is incorrect.

However, running from my dev instance instead of my v5 instance, I get this from the userDir:

> npm ls uuid
node-red-userdir@2.2.0 D:\src\nr\data
+-- node-red-contrib-ical-events@2.2.5
| `-- kalender-events@0.28.3
|   +-- scrapegoat@1.0.1
|   | `-- request@2.88.2
|   |   `-- uuid@3.4.0
|   `-- uuid@8.3.2
+-- node-red-contrib-telegrambot@17.1.3
| `-- node-telegram-bot-api@0.66.0
|   `-- @cypress/request@3.0.10
|     `-- uuid@8.3.2 deduped
+-- node-red-contrib-uibuilder@7.6.2 -> .\..\..\node-red-contrib-uibuilder
| `-- mermaid@11.14.0
|   `-- uuid@11.1.0
`-- node-red-contrib-web-worldmap@5.6.2
  `-- sockjs@0.3.24
    `-- uuid@8.3.2

But, I still don't get any warning from npm audit about uuid.

3

Thanks for looking into this. That's really strange, it is different on my machine. I've setup an empty project (created with npm init) and installed node-red, only. I got the following:

node@nodejs ~/empty-project> npm install node-red
npm warn Unknown global config "python". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn deprecated uuid@9.0.1: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).

added 275 packages, and audited 276 packages in 21s

53 packages are looking for funding
  run `npm fund` for details

3 moderate severity vulnerabilities

To address all issues, run:
  npm audit fix

Run `npm audit` for details.

And it is the same problematic uuid@9.0.1 package, that causes the failure here:

node@nodejs ~/empty-project> npm audit
npm warn Unknown global config "python". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
# npm audit report

uuid  <14.0.0
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix --force`
Will install node-red@1.3.7, which is a breaking change
node_modules/uuid
  @node-red/nodes  2.0.0-beta.1 - 5.0.0-beta.5
  Depends on vulnerable versions of uuid
  node_modules/@node-red/nodes
    node-red  2.0.0-beta.1 - 5.0.0-beta.5
    Depends on vulnerable versions of @node-red/nodes
    node_modules/node-red

3 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

And indeed, there is uuid@9 installed. Here are the installed packages on my machine:

node@nodejs ~/empty-project> node --version
v24.14.1
node@nodejs ~/empty-project> npm --version
11.11.0
node@nodejs ~/empty-project> npm ls uuid
npm warn Unknown global config "python". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
empty-project@1.0.0 /home/node/empty-project
└─┬ node-red@4.1.8
  └─┬ @node-red/nodes@4.1.8
    └── uuid@9.0.1
node@nodejs ~/empty-project [1]> npm ls --tree --all
npm warn Unknown cli config "--tree". This will stop working in the next major version of npm.
npm warn Unknown global config "python". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
empty-project@1.0.0 /home/node/empty-project
└─┬ node-red@4.1.8
  ├─┬ @node-red/editor-api@4.1.8
  │ ├── @node-red/editor-client@4.1.8
  │ ├── @node-red/util@4.1.8 deduped
  │ ├── @node-rs/bcrypt@1.10.7 deduped
  │ ├── bcryptjs@3.0.3 deduped
  │ ├─┬ body-parser@1.20.4
  │ │ ├── bytes@3.1.2
  │ │ ├── content-type@1.0.5 deduped
  │ │ ├── debug@2.6.9 deduped
  │ │ ├── depd@2.0.0 deduped
  │ │ ├── destroy@1.2.0
  │ │ ├── http-errors@2.0.1 deduped
  │ │ ├─┬ iconv-lite@0.4.24
  │ │ │ └── safer-buffer@2.1.2 deduped
  │ │ ├── on-finished@2.4.1 deduped
  │ │ ├── qs@6.14.2 deduped
  │ │ ├─┬ raw-body@2.5.3
  │ │ │ ├── bytes@3.1.2 deduped
  │ │ │ ├── http-errors@2.0.1 deduped
  │ │ │ ├── iconv-lite@0.4.24 deduped
  │ │ │ └── unpipe@1.0.0 deduped
  │ │ ├── type-is@1.6.18 deduped
  │ │ └── unpipe@1.0.0
  │ ├── clone@2.1.2
  │ ├── cors@2.8.5 deduped
  │ ├─┬ express-session@1.18.2
  │ │ ├── cookie-signature@1.0.7
  │ │ ├── cookie@0.7.2 deduped
  │ │ ├── debug@2.6.9 deduped
  │ │ ├── depd@2.0.0 deduped
  │ │ ├── on-headers@1.1.0 deduped
  │ │ ├── parseurl@1.3.3 deduped
  │ │ ├── safe-buffer@5.2.1
  │ │ └─┬ uid-safe@2.1.5
  │ │   └── random-bytes@1.0.0
  │ ├── express@4.22.1 deduped
  │ ├─┬ memorystore@1.6.7
  │ │ ├─┬ debug@4.4.3
  │ │ │ └── ms@2.1.3
  │ │ └─┬ lru-cache@4.1.5
  │ │   ├── pseudomap@1.0.2
  │ │   └── yallist@2.1.2
  │ ├── mime@3.0.0
  │ ├─┬ multer@2.1.1
  │ │ ├── append-field@1.0.0
  │ │ ├─┬ busboy@1.6.0
  │ │ │ └── streamsearch@1.1.0
  │ │ ├─┬ concat-stream@2.0.0
  │ │ │ ├── buffer-from@1.1.2
  │ │ │ ├── inherits@2.0.4 deduped
  │ │ │ ├─┬ readable-stream@3.6.2
  │ │ │ │ ├── inherits@2.0.4 deduped
  │ │ │ │ ├── string_decoder@1.3.0 deduped
  │ │ │ │ └── util-deprecate@1.0.2
  │ │ │ └── typedarray@0.0.6
  │ │ └── type-is@1.6.18 deduped
  │ ├── mustache@4.2.0
  │ ├─┬ oauth2orize@1.12.0
  │ │ ├── debug@2.6.9 deduped
  │ │ ├── uid2@0.0.4
  │ │ └── utils-merge@1.0.1 deduped
  │ ├─┬ passport-http-bearer@1.0.1
  │ │ └── passport-strategy@1.0.0
  │ ├─┬ passport-oauth2-client-password@0.1.2
  │ │ └── passport-strategy@1.0.0 deduped
  │ ├─┬ passport@0.7.0
  │ │ ├── passport-strategy@1.0.0 deduped
  │ │ ├── pause@0.0.1
  │ │ └── utils-merge@1.0.1 deduped
  │ └─┬ ws@7.5.10
  │   ├── UNMET OPTIONAL DEPENDENCY bufferutil@^4.0.1
  │   └── UNMET OPTIONAL DEPENDENCY utf-8-validate@^5.0.2
  ├─┬ @node-red/nodes@4.1.8
  │ ├─┬ acorn-walk@8.3.5
  │ │ └── acorn@8.16.0 deduped
  │ ├── acorn@8.16.0
  │ ├─┬ ajv@8.18.0
  │ │ ├── fast-deep-equal@3.1.3
  │ │ ├── fast-uri@3.1.0
  │ │ ├── json-schema-traverse@1.0.0
  │ │ └── require-from-string@2.0.2
  │ ├── body-parser@1.20.4 deduped
  │ ├─┬ cheerio@1.0.0-rc.10
  │ │ ├─┬ cheerio-select@1.6.0
  │ │ │ ├─┬ css-select@4.3.0
  │ │ │ │ ├── boolbase@1.0.0
  │ │ │ │ ├── css-what@6.2.2 deduped
  │ │ │ │ ├── domhandler@4.3.1 deduped
  │ │ │ │ ├── domutils@2.8.0 deduped
  │ │ │ │ └─┬ nth-check@2.1.1
  │ │ │ │   └── boolbase@1.0.0 deduped
  │ │ │ ├── css-what@6.2.2
  │ │ │ ├── domelementtype@2.3.0
  │ │ │ ├── domhandler@4.3.1 deduped
  │ │ │ └─┬ domutils@2.8.0
  │ │ │   ├── dom-serializer@1.4.1 deduped
  │ │ │   ├── domelementtype@2.3.0 deduped
  │ │ │   └── domhandler@4.3.1 deduped
  │ │ ├─┬ dom-serializer@1.4.1
  │ │ │ ├── domelementtype@2.3.0 deduped
  │ │ │ ├── domhandler@4.3.1 deduped
  │ │ │ └── entities@2.2.0
  │ │ ├─┬ domhandler@4.3.1
  │ │ │ └── domelementtype@2.3.0 deduped
  │ │ ├─┬ htmlparser2@6.1.0
  │ │ │ ├── domelementtype@2.3.0 deduped
  │ │ │ ├── domhandler@4.3.1 deduped
  │ │ │ ├── domutils@2.8.0 deduped
  │ │ │ └── entities@2.2.0 deduped
  │ │ ├─┬ parse5-htmlparser2-tree-adapter@6.0.1
  │ │ │ └── parse5@6.0.1 deduped
  │ │ ├── parse5@6.0.1
  │ │ └── tslib@2.8.1
  │ ├── content-type@1.0.5
  │ ├─┬ cookie-parser@1.4.7
  │ │ ├── cookie-signature@1.0.6 deduped
  │ │ └── cookie@0.7.2 deduped
  │ ├── cookie@0.7.2
  │ ├── cors@2.8.5 deduped
  │ ├── cronosjs@1.7.1
  │ ├── denque@2.1.0
  │ ├─┬ form-data@4.0.4
  │ │ ├── asynckit@0.4.0
  │ │ ├─┬ combined-stream@1.0.8
  │ │ │ └── delayed-stream@1.0.0
  │ │ ├─┬ es-set-tostringtag@2.1.0
  │ │ │ ├── es-errors@1.3.0
  │ │ │ ├─┬ get-intrinsic@1.3.0
  │ │ │ │ ├─┬ call-bind-apply-helpers@1.0.2
  │ │ │ │ │ ├── es-errors@1.3.0 deduped
  │ │ │ │ │ └── function-bind@1.1.2 deduped
  │ │ │ │ ├── es-define-property@1.0.1
  │ │ │ │ ├── es-errors@1.3.0 deduped
  │ │ │ │ ├─┬ es-object-atoms@1.1.1
  │ │ │ │ │ └── es-errors@1.3.0 deduped
  │ │ │ │ ├── function-bind@1.1.2 deduped
  │ │ │ │ ├─┬ get-proto@1.0.1
  │ │ │ │ │ ├─┬ dunder-proto@1.0.1
  │ │ │ │ │ │ ├── call-bind-apply-helpers@1.0.2 deduped
  │ │ │ │ │ │ ├── es-errors@1.3.0 deduped
  │ │ │ │ │ │ └── gopd@1.2.0 deduped
  │ │ │ │ │ └── es-object-atoms@1.1.1 deduped
  │ │ │ │ ├── gopd@1.2.0
  │ │ │ │ ├── has-symbols@1.1.0
  │ │ │ │ ├── hasown@2.0.3 deduped
  │ │ │ │ └── math-intrinsics@1.1.0
  │ │ │ ├─┬ has-tostringtag@1.0.2
  │ │ │ │ └── has-symbols@1.1.0 deduped
  │ │ │ └── hasown@2.0.3 deduped
  │ │ ├─┬ hasown@2.0.3
  │ │ │ └── function-bind@1.1.2
  │ │ └─┬ mime-types@2.1.35
  │ │   └── mime-db@1.52.0
  │ ├── fs-extra@11.3.0 deduped
  │ ├─┬ got@12.6.1
  │ │ ├── @sindresorhus/is@5.6.0
  │ │ ├─┬ @szmarczak/http-timer@5.0.1
  │ │ │ └── defer-to-connect@2.0.1
  │ │ ├── cacheable-lookup@7.0.0
  │ │ ├─┬ cacheable-request@10.2.14
  │ │ │ ├── @types/http-cache-semantics@4.2.0
  │ │ │ ├── get-stream@6.0.1 deduped
  │ │ │ ├── http-cache-semantics@4.2.0
  │ │ │ ├─┬ keyv@4.5.4
  │ │ │ │ └── json-buffer@3.0.1
  │ │ │ ├── mimic-response@4.0.0
  │ │ │ ├── normalize-url@8.1.1
  │ │ │ └── responselike@3.0.0 deduped
  │ │ ├─┬ decompress-response@6.0.0
  │ │ │ └── mimic-response@3.1.0
  │ │ ├── form-data-encoder@2.1.4
  │ │ ├── get-stream@6.0.1
  │ │ ├─┬ http2-wrapper@2.2.1
  │ │ │ ├── quick-lru@5.1.1
  │ │ │ └── resolve-alpn@1.2.1
  │ │ ├── lowercase-keys@3.0.0
  │ │ ├── p-cancelable@3.0.0
  │ │ └─┬ responselike@3.0.0
  │ │   └── lowercase-keys@3.0.0 deduped
  │ ├── hash-sum@2.0.0
  │ ├── hpagent@1.2.0
  │ ├─┬ https-proxy-agent@5.0.1
  │ │ ├─┬ agent-base@6.0.2
  │ │ │ └─┬ debug@4.4.3
  │ │ │   └── ms@2.1.3
  │ │ └─┬ debug@4.4.3
  │ │   └── ms@2.1.3
  │ ├─┬ iconv-lite@0.6.3
  │ │ └── safer-buffer@2.1.2
  │ ├── is-utf8@0.2.1
  │ ├─┬ js-yaml@4.1.1
  │ │ └── argparse@2.0.1
  │ ├── media-typer@1.1.0
  │ ├─┬ mqtt@5.15.0
  │ │ ├─┬ @types/readable-stream@4.0.23
  │ │ │ └─┬ @types/node@25.6.0
  │ │ │   └── undici-types@7.19.2
  │ │ ├─┬ @types/ws@8.18.1
  │ │ │ └── @types/node@25.6.0 deduped
  │ │ ├── commist@3.2.0
  │ │ ├── concat-stream@2.0.0 deduped
  │ │ ├─┬ debug@4.4.3
  │ │ │ └── ms@2.1.3
  │ │ ├── help-me@5.0.0
  │ │ ├── lru-cache@10.4.3
  │ │ ├── minimist@1.2.8 deduped
  │ │ ├─┬ mqtt-packet@9.0.2
  │ │ │ ├─┬ bl@6.1.6
  │ │ │ │ ├── @types/readable-stream@4.0.23 deduped
  │ │ │ │ ├── buffer@6.0.3 deduped
  │ │ │ │ ├── inherits@2.0.4 deduped
  │ │ │ │ └── readable-stream@4.7.0 deduped
  │ │ │ ├─┬ debug@4.4.3
  │ │ │ │ └── ms@2.1.3
  │ │ │ └── process-nextick-args@2.0.1
  │ │ ├─┬ number-allocator@1.0.14
  │ │ │ ├─┬ debug@4.4.3
  │ │ │ │ └── ms@2.1.3
  │ │ │ └── js-sdsl@4.3.0
  │ │ ├─┬ readable-stream@4.7.0
  │ │ │ ├─┬ abort-controller@3.0.0
  │ │ │ │ └── event-target-shim@5.0.1
  │ │ │ ├─┬ buffer@6.0.3
  │ │ │ │ ├── base64-js@1.5.1
  │ │ │ │ └── ieee754@1.2.1
  │ │ │ ├── events@3.3.0
  │ │ │ ├── process@0.11.10
  │ │ │ └─┬ string_decoder@1.3.0
  │ │ │   └── safe-buffer@5.2.1
  │ │ ├── rfdc@1.4.1 deduped
  │ │ ├─┬ socks@2.8.8
  │ │ │ ├── ip-address@10.2.0
  │ │ │ └── smart-buffer@4.2.0
  │ │ ├── split2@4.2.0
  │ │ ├─┬ worker-timers@8.0.31
  │ │ │ ├── @babel/runtime@7.29.2 deduped
  │ │ │ ├── tslib@2.8.1 deduped
  │ │ │ ├─┬ worker-timers-broker@8.0.16
  │ │ │ │ ├── @babel/runtime@7.29.2 deduped
  │ │ │ │ ├─┬ broker-factory@3.1.14
  │ │ │ │ │ ├── @babel/runtime@7.29.2 deduped
  │ │ │ │ │ ├── fast-unique-numbers@9.0.27 deduped
  │ │ │ │ │ ├── tslib@2.8.1 deduped
  │ │ │ │ │ └── worker-factory@7.0.49 deduped
  │ │ │ │ ├─┬ fast-unique-numbers@9.0.27
  │ │ │ │ │ ├── @babel/runtime@7.29.2 deduped
  │ │ │ │ │ └── tslib@2.8.1 deduped
  │ │ │ │ ├── tslib@2.8.1 deduped
  │ │ │ │ └── worker-timers-worker@9.0.14 deduped
  │ │ │ └─┬ worker-timers-worker@9.0.14
  │ │ │   ├── @babel/runtime@7.29.2 deduped
  │ │ │   ├── tslib@2.8.1 deduped
  │ │ │   └─┬ worker-factory@7.0.49
  │ │ │     ├── @babel/runtime@7.29.2 deduped
  │ │ │     ├── fast-unique-numbers@9.0.27 deduped
  │ │ │     └── tslib@2.8.1 deduped
  │ │ └─┬ ws@8.20.0
  │ │   ├── UNMET OPTIONAL DEPENDENCY bufferutil@^4.0.1
  │ │   └── UNMET OPTIONAL DEPENDENCY utf-8-validate@>=5.0.2
  │ ├── multer@2.1.1 deduped
  │ ├── mustache@4.2.0 deduped
  │ ├── node-watch@0.7.4
  │ ├── on-headers@1.1.0
  │ ├─┬ raw-body@3.0.0
  │ │ ├── bytes@3.1.2 deduped
  │ │ ├─┬ http-errors@2.0.0
  │ │ │ ├── depd@2.0.0 deduped
  │ │ │ ├── inherits@2.0.4 deduped
  │ │ │ ├── setprototypeof@1.2.0 deduped
  │ │ │ ├── statuses@2.0.1
  │ │ │ └── toidentifier@1.0.1 deduped
  │ │ ├── iconv-lite@0.6.3 deduped
  │ │ └── unpipe@1.0.0 deduped
  │ ├─┬ tough-cookie@5.1.2
  │ │ └─┬ tldts@6.1.86
  │ │   └── tldts-core@6.1.86
  │ ├── uuid@9.0.1
  │ ├── ws@7.5.10 deduped
  │ └─┬ xml2js@0.6.2
  │   ├── sax@1.6.0
  │   └── xmlbuilder@11.0.1
  ├─┬ @node-red/runtime@4.1.8
  │ ├─┬ @node-red/registry@4.1.8
  │ │ ├── @node-red/util@4.1.8 deduped
  │ │ ├── clone@2.1.2 deduped
  │ │ ├── fs-extra@11.3.0 deduped
  │ │ ├── semver@7.7.4 deduped
  │ │ ├─┬ tar@7.5.12
  │ │ │ ├─┬ @isaacs/fs-minipass@4.0.1
  │ │ │ │ └── minipass@7.1.3 deduped
  │ │ │ ├── chownr@3.0.0
  │ │ │ ├── minipass@7.1.3
  │ │ │ ├─┬ minizlib@3.1.0
  │ │ │ │ └── minipass@7.1.3 deduped
  │ │ │ └── yallist@5.0.0
  │ │ └── uglify-js@3.19.3
  │ ├── @node-red/util@4.1.8 deduped
  │ ├─┬ async-mutex@0.5.0
  │ │ └── tslib@2.8.1 deduped
  │ ├── clone@2.1.2 deduped
  │ ├── cronosjs@1.7.1 deduped
  │ ├── express@4.22.1 deduped
  │ ├── fs-extra@11.3.0 deduped
  │ ├── got@12.6.1 deduped
  │ ├── json-stringify-safe@5.0.1
  │ ├── rfdc@1.4.1
  │ └── semver@7.7.4 deduped
  ├─┬ @node-red/util@4.1.8
  │ ├─┬ chalk@4.1.2
  │ │ ├─┬ ansi-styles@4.3.0
  │ │ │ └─┬ color-convert@2.0.1
  │ │ │   └── color-name@1.1.4
  │ │ └─┬ supports-color@7.2.0
  │ │   └── has-flag@4.0.0
  │ ├── fs-extra@11.3.0 deduped
  │ ├─┬ i18next@25.8.14
  │ │ ├── @babel/runtime@7.29.2
  │ │ └── UNMET OPTIONAL DEPENDENCY typescript@^5
  │ ├── json-stringify-safe@5.0.1 deduped
  │ ├── jsonata@2.0.6
  │ ├── lodash.clonedeep@4.5.0
  │ ├─┬ moment-timezone@0.5.48
  │ │ └── moment@2.30.1 deduped
  │ └── moment@2.30.1
  ├─┬ @node-rs/bcrypt@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-android-arm-eabi@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-android-arm64@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-darwin-arm64@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-darwin-x64@1.10.7
  │ ├── @node-rs/bcrypt-freebsd-x64@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-linux-arm-gnueabihf@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-linux-arm64-gnu@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-linux-arm64-musl@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-linux-x64-gnu@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-linux-x64-musl@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-wasm32-wasi@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-win32-arm64-msvc@1.10.7
  │ ├── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-win32-ia32-msvc@1.10.7
  │ └── UNMET OPTIONAL DEPENDENCY @node-rs/bcrypt-win32-x64-msvc@1.10.7
  ├─┬ basic-auth@2.0.1
  │ └── safe-buffer@5.1.2
  ├── bcryptjs@3.0.3
  ├─┬ cors@2.8.5
  │ ├── object-assign@4.1.1
  │ └── vary@1.1.2
  ├─┬ express@4.22.1
  │ ├─┬ accepts@1.3.8
  │ │ ├── mime-types@2.1.35 deduped
  │ │ └── negotiator@0.6.3
  │ ├── array-flatten@1.1.1
  │ ├── body-parser@1.20.4 deduped
  │ ├─┬ content-disposition@0.5.4
  │ │ └── safe-buffer@5.2.1
  │ ├── content-type@1.0.5 deduped
  │ ├── cookie-signature@1.0.6
  │ ├── cookie@0.7.2 deduped
  │ ├─┬ debug@2.6.9
  │ │ └── ms@2.0.0
  │ ├── depd@2.0.0
  │ ├── encodeurl@2.0.0
  │ ├── escape-html@1.0.3
  │ ├── etag@1.8.1
  │ ├─┬ finalhandler@1.3.2
  │ │ ├── debug@2.6.9 deduped
  │ │ ├── encodeurl@2.0.0 deduped
  │ │ ├── escape-html@1.0.3 deduped
  │ │ ├── on-finished@2.4.1 deduped
  │ │ ├── parseurl@1.3.3 deduped
  │ │ ├── statuses@2.0.2 deduped
  │ │ └── unpipe@1.0.0 deduped
  │ ├── fresh@0.5.2
  │ ├─┬ http-errors@2.0.1
  │ │ ├── depd@2.0.0 deduped
  │ │ ├── inherits@2.0.4
  │ │ ├── setprototypeof@1.2.0 deduped
  │ │ ├── statuses@2.0.2 deduped
  │ │ └── toidentifier@1.0.1
  │ ├── merge-descriptors@1.0.3
  │ ├── methods@1.1.2
  │ ├─┬ on-finished@2.4.1
  │ │ └── ee-first@1.1.1
  │ ├── parseurl@1.3.3
  │ ├── path-to-regexp@0.1.13
  │ ├─┬ proxy-addr@2.0.7
  │ │ ├── forwarded@0.2.0
  │ │ └── ipaddr.js@1.9.1
  │ ├─┬ qs@6.14.2
  │ │ └─┬ side-channel@1.1.0
  │ │   ├── es-errors@1.3.0 deduped
  │ │   ├── object-inspect@1.13.4
  │ │   ├─┬ side-channel-list@1.0.1
  │ │   │ ├── es-errors@1.3.0 deduped
  │ │   │ └── object-inspect@1.13.4 deduped
  │ │   ├─┬ side-channel-map@1.0.1
  │ │   │ ├─┬ call-bound@1.0.4
  │ │   │ │ ├── call-bind-apply-helpers@1.0.2 deduped
  │ │   │ │ └── get-intrinsic@1.3.0 deduped
  │ │   │ ├── es-errors@1.3.0 deduped
  │ │   │ ├── get-intrinsic@1.3.0 deduped
  │ │   │ └── object-inspect@1.13.4 deduped
  │ │   └─┬ side-channel-weakmap@1.0.2
  │ │     ├── call-bound@1.0.4 deduped
  │ │     ├── es-errors@1.3.0 deduped
  │ │     ├── get-intrinsic@1.3.0 deduped
  │ │     ├── object-inspect@1.13.4 deduped
  │ │     └── side-channel-map@1.0.1 deduped
  │ ├── range-parser@1.2.1
  │ ├── safe-buffer@5.2.1
  │ ├─┬ send@0.19.2
  │ │ ├── debug@2.6.9 deduped
  │ │ ├── depd@2.0.0 deduped
  │ │ ├── destroy@1.2.0 deduped
  │ │ ├── encodeurl@2.0.0 deduped
  │ │ ├── escape-html@1.0.3 deduped
  │ │ ├── etag@1.8.1 deduped
  │ │ ├── fresh@0.5.2 deduped
  │ │ ├── http-errors@2.0.1 deduped
  │ │ ├── mime@1.6.0
  │ │ ├── ms@2.1.3
  │ │ ├── on-finished@2.4.1 deduped
  │ │ ├── range-parser@1.2.1 deduped
  │ │ └── statuses@2.0.2 deduped
  │ ├─┬ serve-static@1.16.3
  │ │ ├── encodeurl@2.0.0 deduped
  │ │ ├── escape-html@1.0.3 deduped
  │ │ ├── parseurl@1.3.3 deduped
  │ │ └── send@0.19.2 deduped
  │ ├── setprototypeof@1.2.0
  │ ├── statuses@2.0.2
  │ ├─┬ type-is@1.6.18
  │ │ ├── media-typer@0.3.0
  │ │ └── mime-types@2.1.35 deduped
  │ ├── utils-merge@1.0.1
  │ └── vary@1.1.2 deduped
  ├─┬ fs-extra@11.3.0
  │ ├── graceful-fs@4.2.11
  │ ├─┬ jsonfile@6.2.1
  │ │ ├── graceful-fs@4.2.11 deduped
  │ │ └── universalify@2.0.1 deduped
  │ └── universalify@2.0.1
  ├─┬ node-red-admin@4.1.5
  │ ├── @node-rs/bcrypt@1.10.7 deduped
  │ ├── ansi-colors@4.1.3
  │ ├─┬ axios@1.15.0
  │ │ ├── follow-redirects@1.16.0
  │ │ ├─┬ form-data@4.0.5
  │ │ │ ├── asynckit@0.4.0 deduped
  │ │ │ ├── combined-stream@1.0.8 deduped
  │ │ │ ├── es-set-tostringtag@2.1.0 deduped
  │ │ │ ├── hasown@2.0.3 deduped
  │ │ │ └── mime-types@2.1.35 deduped
  │ │ └── proxy-from-env@2.1.0
  │ ├── bcryptjs@3.0.3 deduped
  │ ├─┬ cli-table@0.3.11
  │ │ └── colors@1.0.3
  │ ├─┬ enquirer@2.4.1
  │ │ ├── ansi-colors@4.1.3 deduped
  │ │ └─┬ strip-ansi@6.0.1
  │ │   └── ansi-regex@5.0.1
  │ ├── minimist@1.2.8
  │ ├── mustache@4.2.0 deduped
  │ └─┬ read@3.0.1
  │   └── mute-stream@1.0.0
  ├─┬ nopt@5.0.0
  │ └── abbrev@1.1.1
  └── semver@7.7.4
4

OK, I was using Windows 11. Just tried on a test install on Debian Linux and got a completely different result. This with just Node-RED v4.1.8

~/nr-public$ npm audit
# npm audit report

uuid  <14.0.0
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix --force`
Will install node-red@1.3.7, which is a breaking change
node_modules/uuid
  @node-red/nodes  2.0.0-beta.1 - 5.0.0-beta.5
  Depends on vulnerable versions of uuid
  node_modules/@node-red/nodes
    node-red  2.0.0-beta.1 - 5.0.0-beta.5
    Depends on vulnerable versions of @node-red/nodes
    node_modules/node-red

3 moderate severity vulnerabilities

Weird that Windows and Linux have very different results.

5

Good that the issue can be replicated. Is Node-RED affected by this security vulnerability?

6

Hard to say really. I don't really know what the vulnerability actually is.

You could always try to see if an override (see the package.json documentation on overrides) to a new version of uuid will work. Hard to say without trying it.

7

I think, that the gap between the used v9 and the current version (v14) looks quite big. Even if it is possible to replace the software package, users won't be sure, if the faulty generated UUIDs aren't baked into flows.json somehow. Someone with more insights into Node-RED is needed here.

8

I agree, just might be worth a try though - but maybe with v12 - so not the latest. I did take a quick look at the breaking changes and I'm pretty sure v14 wouldn't work.

The real question is whether the call(s) to uuid are buried well enough to mitigate the risk. And I don't know the answer I'm afraid. I used to have a direct call to a uuid in the uibuilder code but I got rid of it. Unfortunately, there is a hidden dependency in the docs that I can't get rid of as yet.

9

The uuid problem has settled with latest Node-RED (4.1.9). But now, there are other findings:

brace-expansion  2.0.0 - 2.0.2
Severity: moderate
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
fix available via `npm audit fix`
node_modules/npm/node_modules/brace-expansion
ip-address  <=10.1.0
Severity: moderate
ip-address has XSS in Address6 HTML-emitting methods - https://github.com/advisories/GHSA-v2v4-37r5-5v8g
fix available via `npm audit fix`
node_modules/npm/node_modules/ip-address
picomatch  4.0.0 - 4.0.3
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
10

Not uncommon I'm afraid when using complex node.js apps.

Unless you are in a high-security, highly-sensitive or high-audit environment, you will likely drive yourself crazy trying to chase these down. If you are in one of those environments, you will very likely need the support of some specialist expertise in order to work out whether those issues are actually relevant.

11

@augjoh the audit warnings in 4.1.9 are due to the fact we now bundle the npm module in Node-RED to address other security issues. They have have yet published a maintenance release on their 10.x stream to pickup these updates. We can't update to their 11.x stream due to the older node.js support requirements. Node-RED 5 doesn't have the same constraints so has already moved to npm 11. Not much we can do until they publish an update.