Skip to content

Security - Update @sendgrid/mail dependency on axios to support patched versions for security #1446

@knofte

Description

@knofte

Describe the problem
The package @sendgrid/mail depends on axios < 1.12.0, which is currently vulnerable to a DoS attack via unbounded memory allocation (see CVE/CVSS details and summary: GHSA-4hjh-wcwx-xvwj).

Security Impact
Projects using @sendgrid/mail cannot upgrade axios past 1.11.0, leaving them exposed to a known vulnerability. The issue is fixed in axios version 1.12.0 and above.

Suggested fix
Please update the @sendgrid/mail dependency to allow axios >= 1.12.0. This will allow downstream projects to patch this security issue.

References

Thank you!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions