Skip to content

PMK-1712: Fix Axios Transitive Dependency w/ Vulnerability - #5

Merged
jaballer merged 1 commit into
mainfrom
PMK-1712-fix-dependency-vulnerabilities
Nov 24, 2025
Merged

jaballer merged 1 commit into
mainfrom
PMK-1712-fix-dependency-vulnerabilities

Conversation

@dandigangi

Copy link
Copy Markdown
Contributor

Updates an Axios transitive dependency w/ a reported vulnerability

@J0SUEFDZ

Copy link
Copy Markdown

Some context here:
TL;DR: Axios doesn't check data size when handling data: URIs, allowing attackers to provide extremely large Base64-encoded payloads that consume excessive memory and crash the application.
DependaBot alert: https://github.com/ActiveCampaign/postmark-mcp/security/dependabot/3
GHSA ID: GHSA-4hjh-wcwx-xvwj

@J0SUEFDZ J0SUEFDZ left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀 This is the same process we do for postmark-web: https://github.com/ActiveCampaign/postmark-web/pull/4570/files but since I'm not a security expert, I'll wait for y'all input on this.

@jaballer
jaballer merged commit 889a959 into main Nov 24, 2025
jaballer added a commit that referenced this pull request Apr 29, 2026
…nerabilities

PMK-1712: Fix Axios Transitive Dependency w/ Vulnerability
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants