Npx create-react-app: 8 vulnerabilities (2 moderate, 6 high) in new react app

[harish00506]

PS C:> npx create-react-app mern-stack

Creating a new React app in C:\mern-stack.

Installing packages. This might take a couple of minutes.
Installing react, react-dom, and react-scripts with cra-template...

added 1482 packages in 4m

261 packages are looking for funding
run npm fund for details

Initialized a git repository.

Installing template dependencies using npm...

added 63 packages, and changed 1 package in 25s

261 packages are looking for funding
run npm fund for details
Removing template package using npm...

removed 1 package, and audited 1545 packages in 6s

261 packages are looking for funding
run npm fund for details

8 vulnerabilities (2 moderate, 6 high)

To address all issues (including breaking changes), run:
npm audit fix --force

Run npm audit for details.

Created git commit.

Success! Created mern-stack at C:\Users\LENOVO\Desktop\programing_Files\node_Files\learing_react\mern-stack
Inside that directory, you can run several commands:

npm start
Starts the development server.

npm run build
Bundles the app into static files for production.

npm test
Starts the test runner.

npm run eject
Removes this tool and copies build dependencies, configuration files
and scripts into the app directory. If you do this, you can’t go back!

We suggest that you begin by typing:

cd mern-stack
npm start

Happy hacking!

PS C:\cd .\mern-stack
PS C:\mern-stack> npm fund
mern-stack@0.1.0
├─┬ https://github.com/chalk/chalk?sponsor=1
│ │ └── chalk@4.1.2
│ └── https://github.com/chalk/ansi-styles?sponsor=1
│ └── ansi-styles@4.3.0, ansi-styles@5.2.0, ansi-styles@6.2.1
├── https://github.com/sponsors/jonschlinkert
│ └── picomatch@2.3.1
├── https://github.com/sponsors/sibiraj-s
│ └── ci-info@3.9.0
├── https://github.com/sponsors/ljharb
│ └── deep-equal@2.2.3, array-buffer-byte-length@1.0.1, call-bind@1.0.7, function-bind@1.1.2, define-data-property@1.1.4, gopd@1.0.1, has-property-descriptors@1.0.2, es-get-iterator@1.1.3, has-symbols@1.0.3, is-map@2.0.3, is-set@2.0.3, is-string@1.0.7, has-tostringtag@1.0.2, get-intrinsic@1.2.4, has-proto@1.0.3, is-arguments@1.1.1, is-array-buffer@3.0.4, is-date-object@1.0.5, is-regex@1.1.4, is-shared-array-buffer@1.0.3, object-is@1.1.6, define-properties@1.2.1, object.assign@4.1.5, regexp.prototype.flags@1.5.2, functions-have-names@1.2.3, side-channel@1.0.6, object-inspect@1.13.2, which-boxed-primitive@1.0.2, is-bigint@1.0.4, has-bigints@1.0.2, is-boolean-object@1.1.2, is-number-object@1.0.7, is-symbol@1.0.4, which-collection@1.0.2, is-weakmap@2.0.2, is-weakset@2.0.3, which-typed-array@1.1.15, available-typed-arrays@1.0.7, is-callable@1.2.7, object.values@1.2.0, util.promisify@1.0.1, es-abstract@1.23.3, arraybuffer.prototype.slice@1.0.3, data-view-buffer@1.0.1, data-view-byte-length@1.0.1, data-view-byte-offset@1.0.0, es-to-primitive@1.2.1, function.prototype.name@1.1.6, get-symbol-description@1.0.2, globalthis@1.0.4, is-data-view@1.0.1, is-negative-zero@2.0.3, is-typed-array@1.1.13, is-weakref@1.0.2, safe-array-concat@1.1.2, safe-regex-test@1.0.3, string.prototype.trim@1.2.9, string.prototype.trimend@1.0.8, string.prototype.trimstart@1.0.8, typed-array-byte-length@1.0.1, typed-array-byte-offset@1.0.2, typed-array-length@1.0.6, unbox-primitive@1.0.2, object.getownpropertydescriptors@2.1.8, array.prototype.reduce@1.0.7, minimist@1.2.8, resolve@2.0.0-next.5, supports-preserve-symlinks-flag@1.0.0, qs@6.11.0, array-includes@3.1.8, array.prototype.findlastindex@1.2.5, array.prototype.flat@1.3.2, array.prototype.flatmap@1.3.2, is-core-module@2.15.0, object.fromentries@2.0.8, reflect.getprototypeof@1.0.6, which-builtin-type@1.1.3, is-async-function@2.0.0, is-finalizationregistry@1.0.2, is-generator-function@1.0.10, array.prototype.findlast@1.2.5, string.prototype.matchall@4.0.11, shell-quote@1.8.1
├── https://opencollective.com/babel
│ └── @babel/core@7.24.9
├─┬ https://github.com/sponsors/gregberge
│ │ └── @svgr/webpack@5.5.0, @svgr/core@5.5.0, @svgr/plugin-jsx@5.5.0, @svgr/babel-preset@5.5.0, @svgr/babel-plugin-add-jsx-attribute@5.4.0, @svgr/babel-plugin-remove-jsx-attribute@5.4.0, @svgr/babel-plugin-remove-jsx-empty-expression@5.0.1, @svgr/babel-plugin-replace-jsx-attribute-value@5.0.1, @svgr/babel-plugin-svg-dynamic-title@5.4.0, @svgr/babel-plugin-svg-em-dimensions@5.4.0, @svgr/babel-plugin-transform-react-native-svg@5.4.0, @svgr/babel-plugin-transform-svg-component@5.5.0, @svgr/hast-util-to-babel-ast@5.5.0, @svgr/plugin-svgo@5.5.0
│ └── https://opencollective.com/core-js
│ └── core-js-compat@3.37.1, core-js-pure@3.37.1, core-js@3.37.1
├── https://opencollective.com/browserslist
│ └── browserslist@4.23.2, caniuse-lite@1.0.30001642, update-browserslist-db@1.1.0
├── https://opencollective.com/webpack
│ └── css-loader@6.11.0, css-minimizer-webpack-plugin@3.4.1, eslint-webpack-plugin@3.2.0, file-loader@6.2.0, schema-utils@3.3.0, mini-css-extract-plugin@2.9.0, postcss-loader@6.2.1, sass-loader@12.6.0, source-map-loader@3.0.2, style-loader@3.3.4, terser-webpack-plugin@5.3.10, webpack@5.93.0, webpack-dev-server@4.15.2, webpack-dev-middleware@5.3.4, schema-utils@2.7.0
├─┬ https://opencollective.com/eslint
│ │ └── eslint@8.57.0, @eslint/eslintrc@2.1.4, eslint-scope@7.2.2, eslint-visitor-keys@3.4.3, espree@9.6.1
│ ├── https://github.com/sponsors/nzakas
│ │ └── @humanwhocodes/module-importer@1.0.1
│ └── https://github.com/sponsors/isaacs
│ └── rimraf@3.0.2, glob@10.4.5, foreground-child@3.2.1, signal-exit@4.1.0, jackspeak@3.4.3, minimatch@9.0.5, path-scurry@1.11.1
├─┬ https://opencollective.com/html-webpack-plugin
│ │ └── html-webpack-plugin@5.6.0
│ └── https://github.com/fb55/htmlparser2?sponsor=1
│ └── htmlparser2@6.1.0
├── https://opencollective.com/postcss/
│ └── postcss@7.0.39, autoprefixer@10.4.19, postcss-js@4.0.1, postcss-load-config@4.0.2, postcss-nested@6.2.0
├─┬ https://opencollective.com/csstools
│ │ └── postcss-preset-env@7.8.3, @csstools/postcss-cascade-layers@1.1.1, @csstools/selector-specificity@2.2.0, @csstools/postcss-color-function@1.1.1, @csstools/postcss-font-format-keywords@1.0.1, @csstools/postcss-hwb-function@1.0.2, @csstools/postcss-ic-unit@1.0.1, @csstools/postcss-is-pseudo-class@2.0.7, @csstools/postcss-nested-calc@1.0.0, @csstools/postcss-normalize-display-values@1.0.1, @csstools/postcss-oklab-function@1.1.1, @csstools/postcss-stepped-value-functions@1.0.1, @csstools/postcss-text-decoration-shorthand@1.0.0, @csstools/postcss-trigonometric-functions@1.0.2, @csstools/postcss-unset-value@1.0.2, cssdb@7.11.2, postcss-attribute-case-insensitive@5.0.2, postcss-color-functional-notation@4.2.4, postcss-color-hex-alpha@8.0.4, postcss-color-rebeccapurple@7.1.1, postcss-custom-media@8.0.2, postcss-custom-properties@12.1.11, postcss-custom-selectors@6.0.3, postcss-dir-pseudo-class@6.0.5, postcss-double-position-gradients@3.1.2, postcss-gap-properties@3.0.5, postcss-image-set-function@4.0.7, postcss-lab-function@4.2.1, postcss-nesting@10.2.0, postcss-overflow-shorthand@3.0.4, postcss-place@7.0.5, postcss-pseudo-class-any-link@7.1.6, postcss-selector-not@6.0.1
│ └── https://ko-fi.com/mrcgrtz
│ └── postcss-opacity-percentage@1.1.3
├── https://github.com/sponsors/mdevils
│ └── html-entities@2.5.2
├── https://github.com/chalk/supports-color?sponsor=1
│ └── supports-color@8.1.1
├── https://github.com/avajs/find-cache-dir?sponsor=1
│ └── find-cache-dir@3.3.2
├── https://opencollective.com/typescript-eslint
│ └── @typescript-eslint/eslint-plugin@5.62.0, @typescript-eslint/scope-manager@5.62.0, @typescript-eslint/types@5.62.0, @typescript-eslint/visitor-keys@5.62.0, @typescript-eslint/type-utils@5.62.0, @typescript-eslint/typescript-estree@5.62.0, @typescript-eslint/utils@5.62.0, @typescript-eslint/parser@5.62.0, @typescript-eslint/experimental-utils@5.62.0
├── https://github.com/sindresorhus/emittery?sponsor=1
│ └── emittery@0.10.2
├── https://github.com/sindresorhus/execa?sponsor=1
│ └── execa@5.1.1
├─┬ https://github.com/chalk/strip-ansi?sponsor=1
│ │ └── strip-ansi@7.1.0
│ └── https://github.com/chalk/ansi-regex?sponsor=1
│ └── ansi-regex@6.0.1
├── https://opencollective.com/immer
│ └── immer@9.0.21
└── https://paulmillr.com/funding/
└── chokidar@3.6.0

PS C:\mern-stack> npm install react-scripts@latest

up to date, audited 1545 packages in 4s

261 packages are looking for funding
run npm fund for details

8 vulnerabilities (2 moderate, 6 high)

To address all issues (including breaking changes), run:
npm audit fix --force

Run npm audit for details.
PS C:\mern-stack> npm audit

npm audit report

nth-check <2.0.1
Severity: high
Inefficient Regular Expression Complexity in nth-check - GHSA-rp65-9cf3-cjxr
fix available via npm audit fix --force
Will install react-scripts@3.0.1, which is a breaking change
node_modules/svgo/node_modules/nth-check
css-select <=3.1.0
Depends on vulnerable versions of nth-check
node_modules/svgo/node_modules/css-select
svgo 1.0.0 - 1.3.2
Depends on vulnerable versions of css-select
node_modules/svgo
@svgr/plugin-svgo <=5.5.0
Depends on vulnerable versions of svgo
node_modules/@svgr/plugin-svgo
@svgr/webpack 4.0.0 - 5.5.0
Depends on vulnerable versions of @svgr/plugin-svgo
node_modules/@svgr/webpack
react-scripts >=2.1.4
Depends on vulnerable versions of @svgr/webpack
Depends on vulnerable versions of resolve-url-loader
node_modules/react-scripts

postcss <8.4.31
Severity: moderate
PostCSS line return parsing error - GHSA-7fh5-64p2-3v2j
fix available via npm audit fix --force
Will install react-scripts@3.0.1, which is a breaking change
node_modules/resolve-url-loader/node_modules/postcss
resolve-url-loader 0.0.1-experiment-postcss || 3.0.0-alpha.1 - 4.0.0
Depends on vulnerable versions of postcss
node_modules/resolve-url-loader

8 vulnerabilities (2 moderate, 6 high)

To address all issues (including breaking changes), run:
npm audit fix --force

[bharat407]

Run npm audit fix --force

[harish00506]

i have runed it also same

try this solution: #13607 (comment)

[HiickFG]

I have this PR (#13778), which could hopefully fix it without having to use overrides, etc.

I was having exactly the same on my app. Once I updated the react-scripts package to use latest dependencies on the places where those vulnerable package versions were used, I then got 0 vulnerabilities.