fix(misc): address security CVE cluster (copy-webpack-plugin, koa, minimatch) by jaysoo · Pull Request #34708 · nrwl/nx

jaysoo · 2026-03-04T19:11:19Z

Current Behavior

Several security-related issues reported:

copy-webpack-plugin (@nx/webpack still pins copy-webpack-plugin@^10.2.4 (keeps fast-glob in dependency tree) #34632): @nx/webpack and @nx/next pin copy-webpack-plugin@^10.2.4 which transitively depends on serialize-javascript@^6.0.1 (vulnerable) and fast-glob (supply-chain risk).
koa ([CSV koa 3.0.1] @nx/module-federation@21.6.10 #34621): @nx/module-federation transitively pulls koa@3.0.3 via @module-federation/dts-plugin, which is vulnerable to CVE-2026-27959 (Host Header Injection, fixed in koa 3.1.2).
css-minimizer-webpack-plugin: @nx/webpack pins ^5.0.0 which also depends on vulnerable serialize-javascript@^6.0.1.
@module-federation/enhanced: Versions <2.1.0 transitively install vulnerable koa via dts-plugin.
Next.js: Versions 16.0.x are vulnerable to GHSA-9g9p-9gw9-jx7f (Image Optimizer DoS) and GHSA-5f7q-jpqc-wp7h (PPR Resume memory consumption).
minimatch (minimatch still giving critical vulnerability in 10.2.1 #34701): User reports minimatch vulnerability, but the Nx pnpm catalog already pins the patched version 10.2.4. No code change needed — users should delete their lockfile and reinstall.

Expected Behavior

copy-webpack-plugin bumped to ^14.0.0 which uses serialize-javascript@^7.0.3 (patched). Added noErrorOnMissing: true to all 3 copy-webpack-plugin usage sites to handle the v14 breaking change where missing glob patterns now throw errors by default.
css-minimizer-webpack-plugin bumped to ^8.0.0 which uses serialize-javascript@^7.0.3 (patched).
koa bumped to ^3.1.2 in @nx/node versions.ts. @module-federation/dts-plugin@2.1.0 completely removes koa dependency.
@module-federation/enhanced, runtime, sdk bumped to ^2.1.0 across all packages (@nx/module-federation, @nx/react, @nx/angular, @nx/rspack). Added noErrorOnMissing fix for @module-federation/enhanced 2.x runtime-library-control.plugin.ts compatibility.
Next.js bumped to ~16.1.6 and eslint-config-next to ^16.1.6.
minimatch — no change needed, already resolved.

Migrations added (22.6.0-beta.10)

@nx/module-federation: Bump MF packages to ^2.1.0
@nx/react: Bump @module-federation/enhanced to ^2.1.0
@nx/angular: Bump @module-federation/enhanced to ^2.1.0
@nx/node: Bump koa to ^3.1.2
@nx/next: Bump next to ~16.1.6

Skipped

esbuild (<=0.24.2, moderate severity, dev server only): Fix requires breaking change jump from ^0.19.2 to 0.25+. Will address separately.

Testing

Created a fresh Nx workspace with all affected plugins to verify npm audit is clean after changes:

@nx/next (nextapp)
@nx/webpack (webpackapp)
@nx/rspack (shell, remote1, remote2 via Module Federation)
@nx/module-federation (shell + remotes with MF config)
@nx/react (MF host/remotes)
@nx/node + koa (api)

├── apps
│   ├── api                  # @nx/node (koa)
│   ├── nextapp              # @nx/next
│   ├── remote1              # @nx/react + rspack + MF
│   ├── remote2              # @nx/react + rspack + MF
│   ├── shell                # @nx/react + rspack + MF (host)
│   └── webpackapp           # @nx/webpack

Post-change audit result — only remaining issue is esbuild (moderate, skipped intentionally):

# npm audit report

esbuild  <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server
and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
fix available via `npm audit fix --force`
Will install esbuild@0.27.3, which is a breaking change

1 moderate severity vulnerability

Related Issue(s)

Fixes #34632
Fixes #34621
Fixes #34701

netlify · 2026-03-04T19:11:25Z

✅ Deploy Preview for nx-dev ready!

Name	Link
🔨 Latest commit	`5091899`
🔍 Latest deploy log	https://app.netlify.com/projects/nx-dev/deploys/69aa017a2051f10008395b6a
😎 Deploy Preview	https://deploy-preview-34708--nx-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-03-04T19:11:25Z

✅ Deploy Preview for nx-docs ready!

Name	Link
🔨 Latest commit	`5091899`
🔍 Latest deploy log	https://app.netlify.com/projects/nx-docs/deploys/69aa017a447bac0008000905
😎 Deploy Preview	https://deploy-preview-34708--nx-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

nx-cloud · 2026-03-04T19:11:56Z

View your CI Pipeline Execution ↗ for commit 5091899

Command	Status	Duration	Result
`nx affected --targets=lint,test,build,e2e,e2e-c...`	✅ Succeeded	12m 40s	View ↗
`nx run-many -t check-imports check-lock-files c...`	✅ Succeeded	3m 28s	View ↗
`nx-cloud record -- nx-cloud conformance:check`	✅ Succeeded	8s	View ↗
`nx-cloud record -- nx format:check`	✅ Succeeded	2s	View ↗
`nx-cloud record -- nx sync:check`	✅ Succeeded	<1s	View ↗

☁️ Nx Cloud last updated this comment at 2026-03-05 22:36:49 UTC

vadimka123 · 2026-03-05T05:49:56Z

hi @jaysoo

there also security issue with serialize-javascript
in two places - copy-webpack-plugin and css-minimizer-webpack-plugin
can be css-minimizer-webpack-plugin updated please too?

Mr-Jami · 2026-03-05T16:08:40Z

can we get an update on this?

jaysoo · 2026-03-05T17:56:17Z

there also security issue with serialize-javascript
in two places - copy-webpack-plugin and css-minimizer-webpack-plugin
can be css-minimizer-webpack-plugin updated please too?

I'm taking a look.

nx-cloud

Important

At least one additional CI pipeline execution has run since the conclusion below was written and it may no longer be applicable.

Nx Cloud is proposing a fix for your failed CI:

We updated the test expectations in application.spec.ts to reflect the Next.js version bump from 16.0.1 to 16.1.6. The test was failing because it had hardcoded expectations for the old version numbers, but the PR intentionally upgraded to 16.1.6 to address critical security vulnerabilities (GHSA-9g9p-9gw9-jx7f and GHSA-5f7q-jpqc-wp7h).

Warning

❌ We could not verify this fix.

diff --git a/packages/next/src/generators/application/application.spec.ts b/packages/next/src/generators/application/application.spec.ts
index b83819564c..86b8fa31ba 100644
--- a/packages/next/src/generators/application/application.spec.ts
+++ b/packages/next/src/generators/application/application.spec.ts
@@ -644,8 +644,8 @@ describe('app', () => {
         const packageJson = readJson(tree, '/package.json');
         expect(packageJson).toMatchObject({
           devDependencies: {
-            'eslint-config-next': '^16.0.1',
-            '@next/eslint-plugin-next': '^16.0.1',
+            'eslint-config-next': '^16.1.6',
+            '@next/eslint-plugin-next': '^16.1.6',
           },
         });
       });

🔔 Heads up, your workspace has pending recommendations ↗ to auto-apply fixes for similar failures.

Or Apply changes locally with:

npx nx-cloud apply-locally vWhm-aAmI

Apply fix locally with your editor ↗ View interactive diff ↗

_{🎓 Learn more about Self-Healing CI on nx.dev}

…nimatch) 1. `@nx/webpack` and `@nx/next` depend on `copy-webpack-plugin@^10.2.4` which pulls `fast-glob` (supply-chain risk) and `serialize-javascript@^6.0.2` (GHSA-5c6j-r48x-rmvq, RCE). 2. `@nx/module-federation` depends on `@module-federation/enhanced@^0.21.2` (4 minor versions behind, transitively pulls vulnerable `koa@3.0.3`). 3. `@nx/node` scaffolds projects with `koa@^3.0.3` (CVE-2026-27959). 1. copy-webpack-plugin bumped to `^14.0.0`: drops `fast-glob` for `tinyglobby`, bumps `serialize-javascript` to `^7.0.3`. Verified clean via `npm audit`. 2. `@module-federation/enhanced` and `@module-federation/sdk` bumped to `^2.0.1`. Includes `resolveShare` resolver return type fix for 2.x compatibility. 3. `koaVersion` in `@nx/node` bumped to `^3.1.2` so new projects get the patched version. Note: koa CVE in `@module-federation/dts-plugin` remains an upstream issue (module-federation/core#4419 merged but not yet released). Will be resolved when upstream publishes a new version. Fixes #34632 Fixes #34621 Fixes #34701

Mr-Jami · 2026-03-06T07:21:06Z

@FrozenPandaz @jaysoo quick question, since the PR got merged, when would this be released?

github-actions · 2026-03-12T00:14:01Z

This pull request has already been merged/closed. If you experience issues related to these changes, please open a new issue referencing this pull request.

jaysoo requested review from a team, FrozenPandaz and vsavkin as code owners March 4, 2026 19:11

jaysoo requested a review from Coly010 March 4, 2026 19:11

This comment was marked as outdated.

Sign in to view

jaysoo force-pushed the NXC-4030 branch from d682af5 to e7fe492 Compare March 4, 2026 23:32

jaysoo requested a review from a team as a code owner March 4, 2026 23:32

jaysoo force-pushed the NXC-4030 branch 2 times, most recently from 3650581 to e2d8f02 Compare March 4, 2026 23:43

jaysoo force-pushed the NXC-4030 branch 3 times, most recently from d9064a3 to bc5ef99 Compare March 5, 2026 18:50

jaysoo requested a review from a team as a code owner March 5, 2026 18:50

jaysoo force-pushed the NXC-4030 branch 2 times, most recently from eea2797 to 0f65682 Compare March 5, 2026 19:18

This comment was marked as outdated.

Sign in to view

jaysoo force-pushed the NXC-4030 branch 3 times, most recently from 006acbc to 60e221c Compare March 5, 2026 21:54

nx-cloud bot reviewed Mar 5, 2026

View reviewed changes

jaysoo force-pushed the NXC-4030 branch from 60e221c to 5091899 Compare March 5, 2026 22:19

Coly010 approved these changes Mar 5, 2026

View reviewed changes

FrozenPandaz approved these changes Mar 5, 2026

View reviewed changes

FrozenPandaz merged commit cb6452c into master Mar 5, 2026
24 checks passed

FrozenPandaz deleted the NXC-4030 branch March 5, 2026 22:56

github-actions bot locked as resolved and limited conversation to collaborators Mar 12, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(misc): address security CVE cluster (copy-webpack-plugin, koa, minimatch)#34708

fix(misc): address security CVE cluster (copy-webpack-plugin, koa, minimatch)#34708
FrozenPandaz merged 1 commit intomasterfrom
NXC-4030

jaysoo commented Mar 4, 2026 •

edited

Loading

Uh oh!

netlify bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

netlify bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

nx-cloud bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

vadimka123 commented Mar 5, 2026

Uh oh!

Mr-Jami commented Mar 5, 2026

Uh oh!

jaysoo commented Mar 5, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

nx-cloud bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Mr-Jami commented Mar 6, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

jaysoo commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Current Behavior

Expected Behavior

Migrations added (22.6.0-beta.10)

Skipped

Testing

Related Issue(s)

Uh oh!

netlify bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for nx-dev ready!

Uh oh!

netlify bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for nx-docs ready!

Uh oh!

nx-cloud bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

vadimka123 commented Mar 5, 2026

Uh oh!

Mr-Jami commented Mar 5, 2026

Uh oh!

jaysoo commented Mar 5, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

nx-cloud bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Nx Cloud is proposing a fix for your failed CI:

Uh oh!

Uh oh!

Mr-Jami commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jaysoo commented Mar 4, 2026 •

edited

Loading

netlify bot commented Mar 4, 2026 •

edited

Loading

netlify bot commented Mar 4, 2026 •

edited

Loading

nx-cloud bot commented Mar 4, 2026 •

edited

Loading

nx-cloud bot left a comment •

edited

Loading

Mr-Jami commented Mar 6, 2026 •

edited

Loading