Skip to content

Security - Update @sendgrid/mail dependency on axios to support patched versions for security #1446

Description

@knofte

Describe the problem
The package @sendgrid/mail depends on axios < 1.12.0, which is currently vulnerable to a DoS attack via unbounded memory allocation (see CVE/CVSS details and summary: GHSA-4hjh-wcwx-xvwj).

Security Impact
Projects using @sendgrid/mail cannot upgrade axios past 1.11.0, leaving them exposed to a known vulnerability. The issue is fixed in axios version 1.12.0 and above.

Suggested fix
Please update the @sendgrid/mail dependency to allow axios >= 1.12.0. This will allow downstream projects to patch this security issue.

References

Thank you!

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions