Skip to content

Conversation

@katesaikishore
Copy link

@katesaikishore katesaikishore commented Dec 18, 2025

Why

Snyk identified a high-severity vulnerability in [email protected] (CVE-2025-12816) within the auth0/ad-ldap-connector repository. This vulnerability is introduced via the selfsigned and win-ca dependencies.

What

  • Upgraded selfsigned from ^1.10.4 to ^2.4.1.
  • Upgraded win-ca from ^3.0.4 to ^3.5.1.

How

  • Modified package.json to update the dependency versions.
  • Ran npm install to update package-lock.json.

Tests

  • Verified that node-forge is now at version 1.3.3 (secure) using npm list node-forge.
  • Ran npm test.
    • Note: Some tests may fail due to weak hashing algorithms in the original test/certs.js file, which are rejected by newer Node.js versions.

Rollback

  • Revert the changes in this PR.
  • Downgrade selfsigned and win-ca to their previous versions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant