[Snyk] Security upgrade @nestjs/swagger from 6.2.1 to 11.2.2 #240

TheRedHatter · 2025-11-17T02:49:50Z

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

package.json
package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-JSYAML-13961110	545

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-JSYAML-13961110

AC-KunalParmar · 2025-11-17T02:50:16Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

prisma-cloud-devsecops · 2025-11-17T02:50:36Z

package.json

    "@nestjs/mercurius": "^11.0.3",
    "@nestjs/platform-fastify": "^9.3.9",
-    "@nestjs/swagger": "^6.2.1",
+    "@nestjs/swagger": "^11.2.2",


@nestjs/swagger 11.2.2 / package.json

Total vulnerabilities: 2

Critical: 0 High: 1 Medium: 0 Low: 1

Vulnerability ID Severity CVSS Fixed in Status

CVE-2024-45296 HIGH - - Open

CVE-2025-5889 LOW - - Open

TheRedHatter · 2025-11-17T02:54:18Z

Checkmarx One – Scan Summary & Details – 24ae39c6-a23e-4405-aeed-782592a25ac2

New Issues (23)

Checkmarx found the following issues in this Pull Request

Issue	Source File / Package	Checkmarx Insight
CVE-2022-37616	Npm-xmldom-0.6.0	details Description: A Prototype Pollution vulnerability exists in the function "copy" in "dom.js" in the @xmldom/xmldom for Node.js via the "p" variable. This issue af... Attack Vector: NETWORK Attack Complexity: LOW `ID: JsC0ELOFPSN8zV%2BS2L4JYD4Enu2CtX%2FbomYP9ZkJp9s%3D` Vulnerable Package
CVE-2025-58754	Npm-axios-0.26.1	details Recommended version: 0.30.2 Description: Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to version 1.12.0 runs on Node.js and is given a URL with the "d... Attack Vector: NETWORK Attack Complexity: LOW `ID: Coi1qkaA2O6vRp6heFPhge4MeoRimR19pkMnnAOmhyU%3D` Vulnerable Package
CVE-2025-58754	Npm-axios-0.21.4	details Recommended version: 0.30.2 Description: Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to version 1.12.0 runs on Node.js and is given a URL with the "d... Attack Vector: NETWORK Attack Complexity: LOW `ID: SzU9Gh3BuOnt9JcnRW%2Fxu7Nqb0qgCtQUMv6GyMWsGN8%3D` Vulnerable Package
CVE-2025-9714	Npm-libxmljs-0.19.7	details Description: Uncontrolled recursion in XPath evaluation in libxml2 versions through 2.9.14 allow a local attacker to cause a Stack Overflow via crafted expressi... Attack Vector: LOCAL Attack Complexity: LOW `ID: bp2F5JXCq%2FcOdZKZ95oOt4RWJOS1r%2F1l0Z9sNuXLb5o%3D` Vulnerable Package
Client_HTML5_Insecure_Storage	/client/src/pages/main/Contact.tsx: 18	details The application stores data setItem on the client, in an insecure manner, at line 14 of /client/src/api/makeApiRequest.ts. `ID: uiK52hD26OkcWZgBOsJ25UlWgLY%3D` Attack Vector
Client_HTML5_Insecure_Storage	/client/src/pages/main/Contact.tsx: 15	details The application stores data setItem on the client, in an insecure manner, at line 14 of /client/src/api/makeApiRequest.ts. `ID: JZDg45NluuE%2FqR%2Bp%2BWCS0x1tZLA%3D` Attack Vector
Client_HTML5_Insecure_Storage	/client/src/pages/main/Contact.tsx: 16	details The application stores data setItem on the client, in an insecure manner, at line 14 of /client/src/api/makeApiRequest.ts. `ID: %2BtI6gXdp3CQHT6EvDNvc%2FI39dCw%3D` Attack Vector
Client_HTML5_Insecure_Storage	/client/src/pages/main/Contact.tsx: 17	details The application stores data setItem on the client, in an insecure manner, at line 14 of /client/src/api/makeApiRequest.ts. `ID: TRaxCrq1rJuovIK6EiRB0NFsaXc%3D` Attack Vector
Cx9b50aef6-319d	Npm-nodemailer-6.9.12	details Recommended version: 7.0.7 Description: The email parsing library incorrectly handles quoted local-parts containing '@' in versions through 7.0.6. This leads to misrouting of email recipi... Attack Vector: NETWORK Attack Complexity: LOW `ID: u2Z5a7xymMvI8MVj4%2BbQfmFzS66s4zcHiA0LZ5vDOLM%3D` Vulnerable Package
CVE-2025-6170	Npm-libxmljs-0.19.7	details Description: A flaw was found in the interactive shell of the xmllint tool in libxml2, used for parsing XML files. When a user inputs an overly long command, th... Attack Vector: LOCAL Attack Complexity: HIGH `ID: 9K7R4NJo2UwdwPYY1uwubujo1FE3PLFMSIW2QNvZzM4%3D` Vulnerable Package
Image Pull Policy Of The Container Is Not Set To Always	/deployment.yaml: 30	details Image Pull Policy of the container must be defined and set to Always `ID: jbItttOvKogovAAd%2FH7ig4ypMIA%3D`
Image Pull Policy Of The Container Is Not Set To Always	/deployment.yaml: 30	details Image Pull Policy of the container must be defined and set to Always `ID: kAB29SiF81Xj2yvqEXcagrysLLk%3D`
Image Pull Policy Of The Container Is Not Set To Always	/deployment.yaml: 30	details Image Pull Policy of the container must be defined and set to Always `ID: wXXi0cahCHD4cGDLh4rsNi0F%2BxE%3D`
Missing AppArmor Profile	/deployment.yaml: 15	details Containers should be configured with an AppArmor profile to enforce fine-grained access control over low-level system resources `ID: rVWUGXaxxgPUFH6NVrYH%2BIxRDoI%3D`
Missing AppArmor Profile	/deployment.yaml: 15	details Containers should be configured with an AppArmor profile to enforce fine-grained access control over low-level system resources `ID: FtVqRT0IgpU5fG0V%2FoZRtkWXFjA%3D`
Missing AppArmor Profile	/deployment.yaml: 15	details Containers should be configured with an AppArmor profile to enforce fine-grained access control over low-level system resources `ID: irG%2BNIBc6DWhLX%2BN60f7sxAVZvs%3D`
Missing AppArmor Profile	/deployment.yaml: 15	details Containers should be configured with an AppArmor profile to enforce fine-grained access control over low-level system resources `ID: mE5WzW1JsoXaX7Y%2FDD4RZL6%2BTFg%3D`
Missing AppArmor Profile	/deployment.yaml: 15	details Containers should be configured with an AppArmor profile to enforce fine-grained access control over low-level system resources `ID: AtGpeSzGAaO6IqS8kfZ1%2BmJ2So8%3D`
Pod or Container Without Security Context	/deployment.yaml: 30	details A security context defines privilege and access control settings for a Pod or Container `ID: WRTmMWRmGjWWGOH58Uek%2B3mC6AY%3D`
Pod or Container Without Security Context	/deployment.yaml: 30	details A security context defines privilege and access control settings for a Pod or Container `ID: fT1H%2BQm7xq21r2CSbuHh2HKfYqY%3D`
Pod or Container Without Security Context	/deployment.yaml: 30	details A security context defines privilege and access control settings for a Pod or Container `ID: AESOX60Q5UC39RXXUYls3GmXdxg%3D`
Pod or Container Without Security Context	/deployment.yaml: 30	details A security context defines privilege and access control settings for a Pod or Container `ID: QO1LDg3imADaP%2F3rfRqZzDjA61U%3D`
Pod or Container Without Security Context	/deployment.yaml: 30	details A security context defines privilege and access control settings for a Pod or Container `ID: b3jDxVGkL%2Btdfas40YiFuaUKdSo%3D`

Fixed Issues (14)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~CVE-2025-45767~~	Npm-jose-4.13.1
	~~Image Pull Policy Of The Container Is Not Set To Always~~	/deployment.yaml: 30
	~~Image Pull Policy Of The Container Is Not Set To Always~~	/deployment.yaml: 30
	~~Image Pull Policy Of The Container Is Not Set To Always~~	/deployment.yaml: 30
	~~Missing AppArmor Profile~~	/deployment.yaml: 15
	~~Missing AppArmor Profile~~	/deployment.yaml: 15
	~~Missing AppArmor Profile~~	/deployment.yaml: 15
	~~Missing AppArmor Profile~~	/deployment.yaml: 15
	~~Missing AppArmor Profile~~	/deployment.yaml: 15
	~~Pod or Container Without Security Context~~	/deployment.yaml: 30
	~~Pod or Container Without Security Context~~	/deployment.yaml: 30
	~~Pod or Container Without Security Context~~	/deployment.yaml: 30
	~~Pod or Container Without Security Context~~	/deployment.yaml: 30
	~~Pod or Container Without Security Context~~	/deployment.yaml: 30

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR

fix: package.json & package-lock.json to reduce vulnerabilities

6c8a704

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-JSYAML-13961110

prisma-cloud-devsecops bot reviewed Nov 17, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Security upgrade @nestjs/swagger from 6.2.1 to 11.2.2 #240

[Snyk] Security upgrade @nestjs/swagger from 6.2.1 to 11.2.2 #240

Uh oh!

TheRedHatter commented Nov 17, 2025

Uh oh!

AC-KunalParmar commented Nov 17, 2025 •

edited

Loading

Uh oh!

prisma-cloud-devsecops bot Nov 17, 2025

Uh oh!

TheRedHatter commented Nov 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

[Snyk] Security upgrade @nestjs/swagger from 6.2.1 to 11.2.2 #240

Are you sure you want to change the base?

[Snyk] Security upgrade @nestjs/swagger from 6.2.1 to 11.2.2 #240

Uh oh!

Conversation

TheRedHatter commented Nov 17, 2025

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

Vulnerabilities that will be fixed with an upgrade:

Uh oh!

AC-KunalParmar commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

prisma-cloud-devsecops bot Nov 17, 2025

Choose a reason for hiding this comment

@nestjs/swagger 11.2.2 / package.json

Total vulnerabilities: 2

Uh oh!

TheRedHatter commented Nov 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

AC-KunalParmar commented Nov 17, 2025 •

edited

Loading