Advisory with NPM package elliptic (all versions)

[JaimeValdemoros]

I have an NPM repo running @stackframe/react version 2.8.64, matching the latest at package.json.

npm audit report shows the following:

# npm audit report

elliptic  *
Elliptic Uses a Cryptographic Primitive with a Risky Implementation - https://github.com/advisories/GHSA-848j-6mx2-7j84
No fix available
node_modules/elliptic
  @stackframe/stack-shared  >=2.5.31
  Depends on vulnerable versions of elliptic
  node_modules/@stackframe/react/node_modules/@stackframe/stack-shared
    @stackframe/react  *
    Depends on vulnerable versions of @stackframe/stack-shared
    Depends on vulnerable versions of @stackframe/stack-ui
    node_modules/@stackframe/react
    @stackframe/stack-ui  >=2.5.31
    Depends on vulnerable versions of @stackframe/stack-shared
    node_modules/@stackframe/react/node_modules/@stackframe/stack-ui

4 low severity vulnerabilities

To address issues that do not require attention, run:
  npm audit fix

Some issues need review, and may require choosing
a different dependency.

The advisory being referred to is this one, raised last month: GHSA-848j-6mx2-7j84

[JaimeValdemoros]

This issue indutny/elliptic#343 suggests moving to another package - perhaps this could be considered?

Not suggesting moving to the shim, rather to consider noble-curves as an alternative - it seems elliptic is used in one place, perhaps it's simple enough to replace https://github.com/stack-auth/stack-auth/blob/bb69ee4230d2a4e40ff0b961f288352ea1ec58d3/packages/stack-shared/src/utils/jwt.tsx#L84

[ignaciourbina]

Also experiencing the fast-xml-parser vulnerability (GHSA-jmr7-xgp7-cmfj, high severity) via the AWS SDK dependency chain:

@stackframe/stack-shared → @aws-sdk/client-kms → @aws-sdk/xml-builder → fast-xml-parser 4.1.3 - 5.3.5

The fix requires fast-xml-parser >= 5.3.6. This is blocked on AWS SDK updating their dependency, but wanted to note it here for visibility since it's related to the same transitive dependency concerns.

[JaimeValdemoros]

@ignaciourbina I think these are independent issues with different fixes (one requires changing a dependency, one is just waiting for an update to be released). I don’t know this repo’s policy (I’ll let the maintainers weigh in) but it’s probably different enough to warrant a separate tracking issue