Next.js Cache Poisoning vulnerability on latest react-email 3.0.1

[brandon-rilla]

Anyone else experiencing this security issue?

Looks like it's because react-email is using "Next.js between 13.5.1 and 14.2.9"

I might end up just removing the react-email dependency if they don't upgrade their dependecy to Next.js >14.2.9

[pavelsushkov]

https://github.com/resend/react-email/security/advisories/GHSA-66rw-vq7j-wvq2

and as a temporary solution you can override this dependency in package.json

"overrides": {
  "react-email": {
    "next": "^14.2.15"
  }
},

[brandon-rilla]

Thanks @pavelsushkov

that was one of the things I tried but for some reason, npm didn't follow my overrides and still installed the old version in package-lock.json (I'm assuming this was some NPM bug)

The process to get this override working was pretty involved. I had to manually replace all incorrect versions of next inside package-lock.json with 14.2.15. Then I had to manually find, copy and paste the integrity SHAs directly from the nextjs registry.

Ideally react-email can update this security vulnerability themselves

[dinmukhamedm]

As an additional datapoint, I tried the ovverrides with pnpm and that didn't work out of the box.

I'm pretty sure that's worth opening an issue? @brandon-rilla do you want to open one from this discussion?

[dinmukhamedm]

Apparently fixed in #1692 and staged for release in react-email-3.0.2