Vulnerabilties in v4.1.0-beta.2

General
1

Hi folks,

I have been running some tests with the latest beta image and notice there are some vulnerabilities in npm packages that have available updates. Would these packages get updated prior to general release of this version?

These are the ones I'm seeing after scanning the docker build:

package: form-data 4.0.2, fix available in form-data 4.0.4
critical vulnerability found: NVD - CVE-2025-7783

package: multer v2.0.1, fix available in v2.0.2
high vulnerability found: NVD - CVE-2025-7338

1 Like
2

Hi and Welcome,
Fixed for v4.1: Bump dependencies by knolleary Ā· Pull Request #5224 Ā· node-red/node-red Ā· GitHub

2 Likes
3

Good spot, and thanks for raising.

4

FWIW, the PR was raised and merged 3 days before the OP posted :wink:

image

But as @TotallyInformation said, thanks for raising - sometimes things do get missed (just not this time)

5

I have to say that bumping dependencies is one of the last things I do before creating a new release & publishing. Update the dependencies, run final tests and create a release then publish.