In the last week there have been a growing number of security vulnerabilities discovered in key technologies across the web development ecosystem. Some of which are used on the HunnyDo platform.
Between October 15 and October 25 we have patched every HunnyDo component affected by these issues. The most affected are our Node.js ecosystem: our runtime, our HTTP tooling, file-uploading, and the build and test tooling we use to ship the app. While the issues have been fixed, new advisories are alway a possibility and we are committed to addressing these as soon as possible.
The Node.js runtime upgraded to 22.23.4
On October 21, Node.js published version 22.23.4 (LTS), a release fixing six CVEs in the runtime. Once discovered we promptly patched and redeployed our environment.
| CVE | Severity | What it fixes |
|---|---|---|
| CVE-2026-106069, CVE-2026-106072 | High | TLS now rejects non-canonical IP addresses |
| CVE-2026-105482 | High | DNS lookups reject inputs containing null bytes |
| CVE-2026-111497 | High | A flaw in the bundled Brotli compression library |
| CVE-2026-105481 | Medium | A data guard in the HTTP agent |
| CVE-2026-106074 | Medium | Random-number caches carried across startup snapshots |
| CVE-2026-106073 | Low | A permission-model check in file path resolution |
Patched request and upload handling in the API
The API is the service that stores your checklists, sends reminders and accepts client uploads. Two dependency updates, on October 15 and October 19, cleared every advisory open against it at the time. The ones that matter most run in production and handle incoming requests.
| Package | Worst severity | The issue | Fixed in |
|---|---|---|---|
| proxy-addr | Critical | A client could spoof its IP address through an IPv4-mapped IPv6 address, which matters for rate limiting | 2.0.8 |
| multer | High | Five upload-handling bugs: crafted field names, aborted uploads and a size-limit race could exhaust the server | 2.4.0 |
| body-parser | high | A gzip-compressed request with extra bytes on the end could crash the server | 2.4.0 |
| qs | Moderate | Query-string parsing could be pushed past its limits | 6.16.1 |
| csv-parse | Moderate | A prototype-pollution path when parsing CSV imports | 7.0.3 |
| ip-address | Moderate | Five bugs in IP classification and subnet checks, including slow parsing of long inputs | 10.7.4 |
| express | Moderate | Patched request-handling stack | 5.3.0 |
The remaining advisories affected tools we use to build and test HunnyDo, not the running service: the Vite build tool, the Vitest test runner, PostCSS, nanoid, source-map-js and brace-expansion. We updated them anyway (Vite to 8.3.4, Vitest to 4.1.12) because a compromised developer machine or build is a real path into production. We also refreshed the AWS SDK, Stripe, Postgres and Google sign-in libraries to their current releases.
Earlier in the month we also removed vite-plugin-html, a build plugin we no longer needed, along with more than 40 packages it pulled in. The fewer packages we ship with, the fewer we have to watch. A fresh audit of the web app now reports no known vulnerabilities.
What this means for you
You don’t need to do anything. Most of these bugs would have let an attacker slow down or crash a server, not read your data. The issue with the clearest data angle, IP spoofing in proxy-addr, would at worst have let someone dodge our rate limits. We reviewed our logs for the affected period and found no sign that any of these issues was exploited against HunnyDo.
Your checklists, uploaded documents and client links were never exposed by these vulnerabilities, and you don’t need to change your password.
What we’re doing next
We’ll keep posting here whenever a fix affects HunnyDo. In the meantime, every HunnyDo account now has a dedicated support page. Use this to contact us regarding any questions or concerns you may have regarding your Checklists or account information stored on our system.
Sources
- Node.js 22.23.4 (LTS) release notes
- GitHub Advisory Database, for each GHSA linked above
