diff options
| author | Adam Soltys <[email protected]> | 2026-08-07 22:59:45 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-08-07 23:29:25 -0700 |
| commit | 582eab0d3e78d3c92b3fbf2d41d1845ca5761387 (patch) | |
| tree | 3cb13c9698e2960c1b60071b0c3031952dbca46b /lib/api.ts | |
| parent | f9e8638b2443ebf2da2e11eb12d1a8d60bf7c9d6 (diff) | |
| download | coinos-server-582eab0d3e78d3c92b3fbf2d41d1845ca5761387.tar.gz coinos-server-582eab0d3e78d3c92b3fbf2d41d1845ca5761387.zip | |
upload: require auth on /upload/:type; bump sharp past libvips CVEs (S7)
POST /upload/:type fed the raw uploaded image straight into sharp with
no auth preValidation (unlike neighboring routes), reaching a native
libvips decoder in the container that holds the JWT secret and CLN hot
wallet. Require auth, and bump sharp 0.33.5 -> 0.35.3 (out of the
vulnerable < 0.35.0 libvips range, GHSA-f88m-g3jw-g9cj et al.).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Diffstat (limited to 'lib/api.ts')
0 files changed, 0 insertions, 0 deletions