OPNexus/OPNexus
1
0 Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases 39 Wiki Activity
Files
b2c69f51a0914dc0e3ebbe014e964c201f1091be
OPNexus/docs/security-review-2026-10-07/npm-audit.json
T
Julian Boldt b2c69f51a0
Release / verify (push) Canceled after 0s
Details
CI / checks (push) Canceled after 0s
Details
CI / frontend (push) Canceled after 0s
Details
CI / backend (push) Canceled after 0s
Details
Release / test (push) Canceled after 0s
Details
Release / publish (backend) (push) Canceled after 0s
Details
Release / publish (frontend) (push) Canceled after 0s
Details
Release / publish (proxy) (push) Canceled after 0s
Details
Release / publish (updater) (push) Canceled after 0s
Details
Release v1.19.0 
Backups, Governance, Regelnutzung. Auf einem Test-Stack mit drei Test-Firewalls geprüft; die Vollsicherung Ende-zu-Ende
(sichern, Schaden anrichten, zurückspielen), siehe Handbuch „Konfigurationssicherungen“, „Sichern und Wiederherstellen“.

- **Rolle „Operator“**: rollt aus und betreibt (Regeln, NAT, VPN, Wartung, Sicherungen), verwaltet aber keine
  Benutzer, Einstellungen oder Hosts und lädt keine Roh-Backups herunter. Abgelehnte Versuche stehen im Audit.
  Tokens eines Operators gehen bis zum Bereich „Ausrollen“.
- **Audit-Export** (Einstellungen): Syslog (RFC 5424, UDP/TCP/TLS) und/oder signierter Webhook, mindestens
  einmal zugestellt, ohne Objektinhalte. Neue Tabelle `audit_export_settings` (Migration `0010`).
- **Geplante Backups** mit Aufbewahrung, **verschlüsseltem Offsite-Ziel** (S3-kompatibel, AES-256-GCM,
  Passphrase bleibt auf dem Server), Benachrichtigungen bei Problemen und einer **Änderungsansicht** zwischen
  zwei Sicherungen (Geheimnisse nur als Hash). Neue Tabellen `backup_settings`, `backup_uploads`, Spalte
  `notification_settings.backup_failed_enabled` (Migration `0011`). Die S3-Signatur ist gegen die offiziellen
  AWS-Beispiele geprüft; ein Lauf gegen einen echten Anbieter steht noch aus.
- **Vollsicherung** `opnexus backup --full` und `opnexus restore`: Datenbank und alle Geheimnis-Volumes in einer
  verschlüsselten Datei; Ende-zu-Ende auf dem Test-Stack geprüft (Sichern, Schaden anrichten, Zurückspielen).
- **Regelnutzung**: wann hat jede Regel zuletzt etwas getroffen (aus den pf-Zählern, überlebt Neuladen und
  Neustart); Befund „Regeln in Benutzung“ in der Sicherheitslage nach 30 Tagen ohne Treffer. Neue Tabelle
  `rule_hits` (Migration `0012`).
- Änderungen an Einstellungen (`/api/settings/…`) und das Auslösen von Sicherungen stehen jetzt im Audit.
2026-10-20 00:26:57 +02:00

408 lines
11 KiB
JSON
Raw Blame History

{
"auditReportVersion": 2,
"vulnerabilities": {
"@next/eslint-plugin-next": {
"name": "@next/eslint-plugin-next",
"severity": "high",
"isDirect": false,
"via": [
"fast-glob"
],
"effects": [
"eslint-config-next"
],
"range": ">=14.3.0-canary.0",
"nodes": [
"node_modules/@next/eslint-plugin-next"
],
"fixAvailable": {
"name": "eslint-config-next",
"version": "14.2.35",
"isSemVerMajor": true
}
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1240100,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
"url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-407"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<1.1.21"
},
{
"source": 1240103,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
"url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-407"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=4.0.0 <5.0.12"
},
{
"source": 1240104,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
"url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-674"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<1.1.20"
},
{
"source": 1240107,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
"url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-674"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <5.0.11"
},
{
"source": 1240108,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
"url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-674"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<1.1.19"
},
{
"source": 1240111,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
"url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
"severity": "high",
"cwe": [
"CWE-400",
"CWE-674"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <5.0.10"
}
],
"effects": [],
"range": "<=1.1.20 || 4.0.0 - 5.0.11",
"nodes": [
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion",
"node_modules/brace-expansion"
],
"fixAvailable": true
},
"braces": {
"name": "braces",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1240992,
"name": "braces",
"dependency": "braces",
"title": "braces vulnerable to stack-exhaustion denial of service through deeply nested patterns",
"url": "https://github.com/advisories/GHSA-vfj7-8cjw-p6xm",
"severity": "high",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<=3.0.3"
}
],
"effects": [
"chokidar",
"micromatch"
],
"range": "*",
"nodes": [
"node_modules/braces"
],
"fixAvailable": {
"name": "tailwindcss",
"version": "4.3.3",
"isSemVerMajor": true
}
},
"chokidar": {
"name": "chokidar",
"severity": "high",
"isDirect": false,
"via": [
"braces"
],
"effects": [
"tailwindcss"
],
"range": "2.0.0 - 3.6.0",
"nodes": [
"node_modules/chokidar"
],
"fixAvailable": {
"name": "tailwindcss",
"version": "4.3.3",
"isSemVerMajor": true
}
},
"eslint-config-next": {
"name": "eslint-config-next",
"severity": "high",
"isDirect": true,
"via": [
"@next/eslint-plugin-next"
],
"effects": [],
"range": ">=14.3.0-canary.0",
"nodes": [
"node_modules/eslint-config-next"
],
"fixAvailable": {
"name": "eslint-config-next",
"version": "14.2.35",
"isSemVerMajor": true
}
},
"fast-glob": {
"name": "fast-glob",
"severity": "high",
"isDirect": false,
"via": [
"micromatch"
],
"effects": [
"@next/eslint-plugin-next"
],
"range": "*",
"nodes": [
"node_modules/fast-glob",
"node_modules/tailwindcss/node_modules/fast-glob"
],
"fixAvailable": {
"name": "eslint-config-next",
"version": "14.2.35",
"isSemVerMajor": true
}
},
"micromatch": {
"name": "micromatch",
"severity": "high",
"isDirect": false,
"via": [
"braces"
],
"effects": [
"fast-glob",
"tailwindcss"
],
"range": ">=0.2.0",
"nodes": [
"node_modules/micromatch"
],
"fixAvailable": {
"name": "tailwindcss",
"version": "4.3.3",
"isSemVerMajor": true
}
},
"postcss-nested": {
"name": "postcss-nested",
"severity": "moderate",
"isDirect": false,
"via": [
"postcss-selector-parser"
],
"effects": [],
"range": "2.0.3 - 6.2.0",
"nodes": [
"node_modules/postcss-nested"
],
"fixAvailable": true
},
"postcss-selector-parser": {
"name": "postcss-selector-parser",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1241232,
"name": "postcss-selector-parser",
"dependency": "postcss-selector-parser",
"title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion",
"url": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-407"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.1.6"
}
],
"effects": [
"postcss-nested",
"tailwindcss"
],
"range": "<7.1.6",
"nodes": [
"node_modules/postcss-selector-parser"
],
"fixAvailable": {
"name": "tailwindcss",
"version": "4.3.3",
"isSemVerMajor": true
}
},
"sharp": {
"name": "sharp",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1241331,
"name": "sharp",
"dependency": "sharp",
"title": "sharp : Vulnerability in librsvg dependency CVE-2026-96889",
"url": "https://github.com/advisories/GHSA-wq5f-xc86-pv6w",
"severity": "high",
"cwe": [
"CWE-416",
"CWE-1395"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.35.5"
}
],
"effects": [],
"range": "<0.35.5",
"nodes": [
"node_modules/sharp"
],
"fixAvailable": true
},
"source-map-js": {
"name": "source-map-js",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1241209,
"name": "source-map-js",
"dependency": "source-map-js",
"title": "source-map-js allows event-loop denial of service through indexed source-map section offsets",
"url": "https://github.com/advisories/GHSA-68fv-2mgg-jv7q",
"severity": "high",
"cwe": [
"CWE-1284"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=1.0.0 <1.2.2"
}
],
"effects": [],
"range": "1.0.0 - 1.2.1",
"nodes": [
"node_modules/source-map-js"
],
"fixAvailable": true
},
"tailwindcss": {
"name": "tailwindcss",
"severity": "high",
"isDirect": true,
"via": [
"chokidar",
"fast-glob",
"micromatch",
"postcss-nested",
"postcss-selector-parser"
],
"effects": [],
"range": "<=0.0.0-oxide-insiders.ff2c25f || 0.5.0 - 3.4.19",
"nodes": [
"node_modules/tailwindcss"
],
"fixAvailable": {
"name": "tailwindcss",
"version": "4.3.3",
"isSemVerMajor": true
}
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 2,
"high": 10,
"critical": 0,
"total": 12
},
"dependencies": {
"prod": 46,
"dev": 332,
"optional": 14,
"peer": 0,
"peerOptional": 0,
"total": 390
}
}
}
Reference in new issue View Git Blame Copy Permalink