{"vulnerability": "cve-2026-5560", "sightings": [{"uuid": "d0a0a45a-aa12-40f7-b820-3baa36683c21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5560", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miqs3e4njf23", "content": "", "creation_timestamp": "2026-04-05T12:51:36.358435Z"}, {"uuid": "e44eea52-fb1e-447a-9fc9-d49ec100d908", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55603", "type": "published-proof-of-concept", "source": "https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm", "content": "", "creation_timestamp": "2026-06-17T17:17:39.000000Z"}, {"uuid": "97e4e824-c017-4b43-b75f-ff267c5a0fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55602", "type": "published-proof-of-concept", "source": "https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj", "content": "", "creation_timestamp": "2026-06-17T17:17:28.000000Z"}, {"uuid": "ba0068d4-71b2-46ba-b1c9-f50f336e6cc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55603", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mox25jonrk2t", "content": "CVE-2026-55603 - CRLF Injection in Http-proxy-middleware. CVSS 7.5. Allows header manipulation via multipart form data. No patch available yet. Mitigate by avoiding untrusted input in body parsers. #CVE #infosec #nodejs\n\nhttps://www.valtersit.com/cve/CVE-2026-55603/", "creation_timestamp": "2026-06-23T09:03:07.163423Z"}, {"uuid": "aff4e4db-e7fa-4535-b312-63b556d8e268", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55607", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgusuta6d2b", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55607 \u0432 Claude Code: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/D079304F-C993-417E-A292-5A7180997710", "creation_timestamp": "2026-06-29T16:10:20.520490Z"}, {"uuid": "9a8102d2-0af1-4c6d-83fc-63b1350d468e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55604", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqap3r6pk42e", "content": "CVE-2026-55604 - @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key\nCVE ID : CVE-2026-55604\n \n Published : July 9, 2026, 10:17 p.m. | 15\u00a0minutes ago\n \n Description : DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4...", "creation_timestamp": "2026-07-09T22:37:06.502611Z"}, {"uuid": "560751ba-9539-4332-8769-8e9d38e8fe5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55604", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqbeluswmw2a", "content": "\ud83d\udfe0 CVE-2026-55604 - High (8.6)\n\nDeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to vers...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55604/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-10T05:01:55.462882Z"}, {"uuid": "af3e1f91-72e0-4d5d-a7fc-429d8bc6fd5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55605", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcrtzifdi2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55605 \u0432 DeepSeek MCP Server: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/9D6C46B7-0C4E-498E-AAC8-C1FB0F8FA577", "creation_timestamp": "2026-07-10T18:31:48.592570Z"}, {"uuid": "f2a21e2b-55f8-453a-8752-0a5ffa3efe9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55605", "type": "seen", "source": "https://gist.github.com/alon710/d086a00580da0e8964a59634ddcd20cd", "content": "# CVE-2026-55605: CVE-2026-55605: Missing Authentication in @arikusi/deepseek-mcp-server HTTP Transport Endpoint\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55605\n\n## Summary\nThe self-hosted HTTP transport mode of @arikusi/deepseek-mcp-server (an MCP server for DeepSeek V4) exposes its JSON-RPC endpoint (POST /mcp) without authentication in versions 1.4.2 through 1.7.0. Unauthenticated clients can establish Model Context Protocol sessions and invoke tools, consuming the host's configured DeepSeek API key.\n\n## TL;DR\nUnauthenticated remote attackers can query DeepSeek models and deplete system quotas via an exposed JSON-RPC endpoint on port 3000.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 5.3 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n- **Affected Component**: HTTP Transport Mode (transport-http.ts)\n\n## Affected Systems\n\n- @arikusi/deepseek-mcp-server\n- **@arikusi/deepseek-mcp-server**: >= 1.4.2, < 1.8.0 (Fixed in: `1.8.0`)\n\n## Mitigation\n\n- Upgrade to version 1.8.0 or higher\n- Configure HTTP_AUTH_TOKEN environment variable\n- Restrict service binding to localhost (127.0.0.1)\n\n**Remediation Steps:**\n1. Update NPM dependencies to retrieve the patched package version.\n2. Set the HTTP_AUTH_TOKEN environment variable to a strong, generated secret.\n3. Modify Docker Compose or host binding configurations to prevent exposure to untrusted networks.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55605) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T19:32:23.850349Z"}, {"uuid": "a66721a2-878c-4290-aad7-5f0af9c94413", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55605", "type": "published-proof-of-concept", "source": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-72f3-6w86-7rv3", "content": "", "creation_timestamp": "2026-08-25T20:35:10.446016Z"}, {"uuid": "df6d928e-3624-43c4-bb8a-9a287690d9f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55604", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-fh3r-g96v-f578", "content": "", "creation_timestamp": "2026-08-25T20:35:12.816538Z"}, {"uuid": "4edfc2c7-74ad-457b-991d-404e2e81db1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55609", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mtwrpag3u42q", "content": "\u5bfe\u8c61\u88fd\u54c1\u306fconsciousness-explorer 1.1.2\u672a\u6e80\u304a\u3088\u3073sublinear-time-solver 1.6.0\u672a\u6e80\u3002 \u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u306e\u5165\u529b\u691c\u8a3c\u304c\u4e0d\u5341\u5206\u306a\u8106\u5f31\u6027\u304c\u3042\u308a\u3001\u653b\u6483\u8005\u304cMCP\u2026\nCVE-2026-55609 CVSS 7.1 | HIGH", "creation_timestamp": "2026-08-25T21:37:55.895561Z"}, {"uuid": "49060a5f-33b5-4dd3-a6f0-e71b241570eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55603", "type": "seen", "source": "https://gist.github.com/djlan/d3d5af1f1464e07e7c7b819bf0d68369", "content": "# [SECURITY][SFI] \u4fee\u590d http-proxy-middleware \u6f0f\u6d1e\uff08CVE-2026-55603\uff09\n\n> **\u4e00\u53e5\u8bdd\u603b\u7ed3\uff1a** \u6b64 PR \u5728 Angular \u793a\u4f8b\u5bbf\u4e3b\u5e94\u7528\u4e2d\u901a\u8fc7 npm `overrides` \u5c06\u4f20\u9012\u4f9d\u8d56 `http-proxy-middleware` \u7cbe\u786e\u9501\u5b9a\u5230\u5df2\u4fee\u590d\u7684 `3.0.7`\uff0c\u5e76\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\uff0c\u4f7f\u539f\u6709\u7684 `3.0.5` \u548c\u5d4c\u5957 `2.0.10` \u526f\u672c\u7edf\u4e00\u89e3\u6790\u4e3a\u8be5\u7248\u672c\u3002\n\n| \u9879\u76ee | \u4fe1\u606f |\n|---|---|\n| PR | [766461](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766461) |\n| \u4f5c\u8005 | Agency |\n| \u72b6\u6001 | Active\uff0c\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u5206\u652f | `copilot/api-690bd71d-9c587336` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-08-05 09:50:47 |\n| \u63d0\u4ea4\u6570 | 1 |\n| \u8fed\u4ee3\u6570 | 2 |\n| \u53d8\u66f4\u7edf\u8ba1 | 2 \u4e2a\u6587\u4ef6\uff0c17 \u884c\u65b0\u589e\u300143 \u884c\u5220\u9664 |\n| \u5dee\u5f02\u6765\u6e90 | `git-local`\uff0c\u603b\u8ba1 7,274 \u5b57\u8282 |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n6. [\u5dee\u5f02\u8986\u76d6\u8303\u56f4](#\u5dee\u5f02\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5\u53d8\u66f4\u9488\u5bf9 Component Governance \u8b66\u62a5 14745743 \u6240\u6307\u5411\u7684\u9ad8\u4e25\u91cd\u6027\u6f0f\u6d1e CVE-2026-55603\u3002\u95ee\u9898\u4f9d\u8d56\u4e0d\u662f\u5e94\u7528\u76f4\u63a5\u58f0\u660e\u7684\u8fd0\u884c\u65f6\u4f9d\u8d56\uff0c\u800c\u662f\u7531\u5f00\u53d1\u4f9d\u8d56 `@angular-devkit/build-angular@21.2.16` \u95f4\u63a5\u5f15\u5165\uff0c\u56e0\u6b64 PR \u6ca1\u6709\u4fee\u6539\u4e1a\u52a1\u6e90\u7801\uff0c\u800c\u662f\u4f7f\u7528 npm \u7684\u4f9d\u8d56\u8986\u76d6\u673a\u5236\u63a7\u5236\u6574\u4e2a\u5b89\u88c5\u6811\u4e2d\u7684\u5b9e\u9645\u89e3\u6790\u7248\u672c\u3002\n\n\u6838\u5fc3\u505a\u6cd5\u5206\u4e3a\u4e24\u6b65\uff1a\n\n1. \u5728 [`sample/angular-host-app/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766461?path=/sample/angular-host-app/package.json&_a=files) \u7684\u73b0\u6709 `overrides` \u4e2d\u52a0\u5165 `\"http-proxy-middleware\": \"3.0.7\"`\u3002\n2. \u91cd\u65b0\u751f\u6210 [`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766461?path=/sample/angular-host-app/package-lock.json&_a=files)\uff0c\u8bb0\u5f55\u65b0\u7684\u5305\u7248\u672c\u3001\u5b8c\u6574\u6027\u54c8\u5e0c\u3001Node.js \u5f15\u64ce\u7ea6\u675f\u4ee5\u53ca\u53bb\u91cd\u540e\u7684\u4f9d\u8d56\u6811\u3002\n\n## \u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. npm \u4f9d\u8d56\u8986\u76d6\u7b56\u7565\n\n**\u6587\u4ef6\uff1a** [`sample/angular-host-app/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766461?path=/sample/angular-host-app/package.json&_a=files)\n\n\u6b64\u6587\u4ef6\u589e\u52a0\u4e86\u5bf9 `http-proxy-middleware` \u7684\u7cbe\u786e\u7248\u672c\u8986\u76d6\u3002\u8fd9\u6837\u505a\u7684\u539f\u56e0\u662f\u666e\u901a\u7684\u9876\u5c42\u4f9d\u8d56\u5347\u7ea7\u65e0\u6cd5\u76f4\u63a5\u63a7\u5236\u7531 Angular \u6784\u5efa\u5de5\u5177\u7b49\u4e0a\u6e38\u5305\u5e26\u5165\u7684\u4f20\u9012\u4f9d\u8d56\uff0c\u800c npm `overrides` \u4f1a\u5728\u5b89\u88c5\u65f6\u5f3a\u5236\u4f9d\u8d56\u6811\u4f7f\u7528\u6307\u5b9a\u7248\u672c\u3002\n\n\u9009\u62e9\u7cbe\u786e\u7248\u672c `3.0.7` \u800c\u4e0d\u662f\u8303\u56f4\u8868\u8fbe\u5f0f\uff0c\u53ef\u4ee5\u786e\u4fdd\u672c\u5730\u5f00\u53d1\u3001CI \u548c\u540e\u7eed\u9501\u6587\u4ef6\u91cd\u5efa\u90fd\u4e0d\u4f1a\u91cd\u65b0\u9009\u4e2d\u5b58\u5728\u6f0f\u6d1e\u7684\u65e7\u7248\u672c\uff0c\u4e5f\u4e0d\u4f1a\u672a\u7ecf\u8bc4\u4f30\u81ea\u52a8\u6f02\u79fb\u5230\u672a\u6765\u7248\u672c\u3002\u8be5\u65b9\u5f0f\u5c06\u5b89\u5168\u4fee\u590d\u96c6\u4e2d\u5728\u5305\u7ba1\u7406\u914d\u7f6e\u5c42\uff0c\u4e0d\u9700\u8981\u66f4\u6539\u4ee3\u7406\u8c03\u7528\u4ee3\u7801\u6216 Angular \u6784\u5efa\u914d\u7f6e\u3002\n\n### 2. \u6f0f\u6d1e\u7248\u672c\u5347\u7ea7\u4e0e\u9501\u5b9a\n\n**\u6587\u4ef6\uff1a** [`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766461?path=/sample/angular-host-app/package-lock.json&_a=files)\n\n\u9501\u6587\u4ef6\u4e2d\u7684\u9876\u5c42 `http-proxy-middleware` \u4ece `3.0.5` \u66f4\u65b0\u4e3a `3.0.7`\uff0c\u540c\u65f6\u66f4\u65b0\u4e86\u79c1\u6709 npm \u6e90\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\u3002\u8fd9\u4fdd\u8bc1\u6267\u884c\u57fa\u4e8e\u9501\u6587\u4ef6\u7684\u5b89\u88c5\u65f6\u4f1a\u83b7\u53d6\u4fee\u590d\u540e\u7684\u786e\u5b9a\u7248\u672c\uff0c\u800c\u4e0d\u662f\u4ec5\u5728\u6e05\u5355\u5c42\u8868\u8fbe\u4fee\u590d\u610f\u56fe\u3002\n\n\u65b0\u7248\u672c\u58f0\u660e\u7684 Node.js \u5f15\u64ce\u4e0b\u9650\u4ece Node 14 \u7684 `14.15.0` \u63d0\u9ad8\u5230 `14.18.0`\uff1bNode 16 \u7684\u4e0b\u9650\u4ecd\u4e3a `16.10.0`\uff0cNode 18 \u53ca\u4ee5\u4e0a\u4ecd\u53d7\u652f\u6301\u3002\u8fd9\u662f\u6b64\u6b21\u8865\u4e01\u5347\u7ea7\u5e26\u6765\u7684\u660e\u786e\u73af\u5883\u517c\u5bb9\u6027\u53d8\u5316\u3002\n\n### 3. \u4f9d\u8d56\u6811\u53bb\u91cd\n\n\u9501\u6587\u4ef6\u79fb\u9664\u4e86 `webpack-dev-server` \u4e0b\u5355\u72ec\u5d4c\u5957\u7684 `http-proxy-middleware@2.0.10`\uff0c\u4f7f\u5176\u6539\u4e3a\u590d\u7528\u88ab\u8986\u76d6\u5230 `3.0.7` \u7684\u7248\u672c\u3002\u968f\u8be5\u5d4c\u5957\u526f\u672c\u4e00\u540c\u79fb\u9664\u7684\u8fd8\u6709\u4ec5\u7531\u5b83\u9700\u8981\u7684 `is-plain-obj@3.0.0`\u3002\n\n\u8fd9\u8bf4\u660e\u8986\u76d6\u89c4\u5219\u4e0d\u53ea\u4fee\u590d\u539f\u5148\u7684\u9876\u5c42 `3.0.5`\uff0c\u4e5f\u4f5c\u7528\u5230\u4e86\u53e6\u4e00\u6761\u4f20\u9012\u4f9d\u8d56\u8def\u5f84\uff0c\u4ece\u5b89\u88c5\u6811\u4e2d\u6d88\u9664\u4e86\u7b2c\u4e8c\u4e2a\u65e7\u7248\u672c\u526f\u672c\u3002\u4f9d\u8d56\u6811\u56e0\u6b64\u66f4\u7b80\u5355\uff0c\u4f46 `webpack-dev-server` \u5b9e\u9645\u4f7f\u7528\u7684\u4e2d\u95f4\u4ef6\u8de8\u8d8a\u4e86\u4e3b\u7248\u672c\uff0c\u4ece `2.x` \u53d8\u4e3a `3.x`\uff0c\u9700\u8981\u7531\u6784\u5efa\u548c\u5f00\u53d1\u670d\u52a1\u5668\u573a\u666f\u786e\u8ba4\u884c\u4e3a\u517c\u5bb9\u3002\n\n### 4. \u9501\u6587\u4ef6\u5143\u6570\u636e\u5f52\u7c7b\n\n\u82e5\u5e72\u53ef\u9009\u4f9d\u8d56\u8282\u70b9\u65b0\u589e\u4e86 `dev: true` \u6807\u8bb0\uff0c\u5305\u62ec `errno`\u3001`image-size`\u3001`make-dir`\u3001`mime`\u3001`semver`\u3001`source-map`\u3001`needle`\u3001`iconv-lite`\u3001`pify`\u3001`prr` \u548c `sax`\u3002\u8fd9\u4e9b\u53d8\u5316\u770b\u8d77\u6765\u662f\u91cd\u65b0\u89e3\u6790/\u751f\u6210\u9501\u6587\u4ef6\u540e\u5bf9\u5f00\u53d1\u4f9d\u8d56\u5c5e\u6027\u7684\u89c4\u8303\u5316\u8bb0\u5f55\uff0c\u800c\u4e0d\u662f\u8fd9\u4e9b\u5305\u672c\u8eab\u7684\u7248\u672c\u5347\u7ea7\u3002\n\n\u8fd9\u7c7b\u5143\u6570\u636e\u4f1a\u5f71\u54cd npm \u5bf9\u751f\u4ea7\u4f9d\u8d56\u4e0e\u5f00\u53d1\u4f9d\u8d56\u7684\u5206\u7c7b\uff0c\u4f46\u4ece\u5f53\u524d\u5dee\u5f02\u770b\uff0c\u6ca1\u6709\u5bf9\u5e94\u5305\u7248\u672c\u6216\u4e0b\u8f7d\u5185\u5bb9\u53d8\u5316\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u5b89\u5168\u5f71\u54cd\n\n- \u76f4\u63a5\u76ee\u6807\u662f\u6d88\u9664\u4f9d\u8d56\u6811\u4e2d\u7684 CVE-2026-55603 \u6613\u53d7\u653b\u51fb\u7248\u672c\u3002\n- \u7cbe\u786e\u8986\u76d6\u540c\u65f6\u66ff\u6362\u4e86 `3.0.5` \u548c\u5d4c\u5957\u7684 `2.0.10`\uff0c\u8986\u76d6\u8303\u56f4\u6bd4\u53ea\u66f4\u65b0\u5355\u4e00\u9501\u6587\u4ef6\u8282\u70b9\u66f4\u5b8c\u6574\u3002\n- \u56fa\u5b9a\u7248\u672c\u53ef\u907f\u514d\u5b89\u88c5\u65f6\u56e0\u8bed\u4e49\u5316\u7248\u672c\u91cd\u65b0\u89e3\u6790\u800c\u56de\u9000\u5230\u65e7\u7248\u672c\u3002\n\n### \u6784\u5efa\u4e0e\u5f00\u53d1\u4f53\u9a8c\n\n- \u53d8\u66f4\u4f4d\u4e8e `sample/angular-host-app`\uff0c\u5e76\u4e14\u76f8\u5173\u5305\u5728\u9501\u6587\u4ef6\u4e2d\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u56e0\u6b64\u4e3b\u8981\u5f71\u54cd\u8be5\u793a\u4f8b\u5e94\u7528\u7684\u5b89\u88c5\u3001Angular \u6784\u5efa\u53ca\u5f00\u53d1\u670d\u52a1\u5668\u6d41\u7a0b\u3002\n- \u6ca1\u6709\u4e1a\u52a1\u6e90\u7801\u3001\u8eab\u4efd\u9a8c\u8bc1\u914d\u7f6e\u6216\u751f\u4ea7\u670d\u52a1\u914d\u7f6e\u53d8\u66f4\u3002\n- \u9501\u6587\u4ef6\u7ee7\u7eed\u5f15\u7528 Azure DevOps \u79c1\u6709 npm \u6e90\uff1b\u5177\u5907\u76f8\u5e94\u6e90\u8bbf\u95ee\u6743\u9650\u7684\u73af\u5883\u624d\u80fd\u6309\u9501\u6587\u4ef6\u5b8c\u6210\u5b89\u88c5\u3002\n\n### \u90e8\u7f72\u4e0e\u8fd0\u884c\u65f6\n\n- \u4ece\u5305\u5185\u5dee\u5f02\u53ef\u89c1\uff0c\u8be5\u4f9d\u8d56\u88ab\u5f52\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u9884\u671f\u4e0d\u4f1a\u8fdb\u5165\u4ec5\u5b89\u88c5\u751f\u4ea7\u4f9d\u8d56\u7684\u90e8\u7f72\u4ea7\u7269\u3002\n- \u5982\u679c\u5b9e\u9645\u4ea4\u4ed8\u6d41\u7a0b\u4f1a\u6253\u5305\u5f00\u53d1\u670d\u52a1\u5668\u3001\u4e2d\u95f4\u4ef6\u6216\u5b8c\u6574 `node_modules`\uff0c\u4ecd\u5e94\u786e\u8ba4\u6700\u7ec8\u5236\u54c1\u4e2d\u89e3\u6790\u5230\u7684\u662f `3.0.7`\uff0c\u4e0d\u80fd\u4ec5\u4f9d\u8d56 `dev` \u6807\u8bb0\u63a8\u65ad\u8fd0\u884c\u65f6\u5b8c\u5168\u4e0d\u53d7\u5f71\u54cd\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\n\n| \u98ce\u9669 | \u5177\u4f53\u8868\u73b0 | \u5efa\u8bae |\n|---|---|---|\n| Node.js \u7248\u672c\u4e0b\u9650\u53d8\u5316 | `http-proxy-middleware@3.0.7` \u5bf9 Node 14 \u7684\u6700\u4f4e\u8981\u6c42\u7531 `14.15.0` \u63d0\u5347\u5230 `14.18.0` | \u786e\u8ba4\u5f00\u53d1\u673a\u548c CI \u672a\u4f7f\u7528 Node 14.15\u201314.17\uff1bNode 16.10+ \u6216 Node 18+ \u4e0d\u53d7\u8be5\u53d8\u5316\u5f71\u54cd |\n| \u4f20\u9012\u4f9d\u8d56\u8de8\u4e3b\u7248\u672c\u66ff\u6362 | `webpack-dev-server` \u539f\u5148\u5d4c\u5957\u4f7f\u7528 `2.0.10`\uff0c\u73b0\u5728\u56e0\u5168\u5c40\u8986\u76d6\u6539\u7528 `3.0.7` | \u8fd0\u884c Angular \u5f00\u53d1\u670d\u52a1\u5668\u548c\u4ee3\u7406\u76f8\u5173\u573a\u666f\uff0c\u68c0\u67e5\u542f\u52a8\u3001\u8f6c\u53d1\u3001WebSocket\u3001\u8def\u5f84\u91cd\u5199\u53ca\u9519\u8bef\u5904\u7406 |\n| \u5168\u5c40\u8986\u76d6\u5f71\u54cd\u8303\u56f4 | npm `overrides` \u4f1a\u4f5c\u7528\u4e8e\u8be5\u5305\u6811\u4e2d\u6240\u6709\u5339\u914d\u7684 `http-proxy-middleware`\uff0c\u4e0d\u4ec5\u662f\u6f0f\u6d1e\u62a5\u544a\u4e2d\u7684\u5355\u4e00\u8def\u5f84 | \u68c0\u67e5 `npm ls http-proxy-middleware`\uff0c\u786e\u8ba4\u6240\u6709\u6d88\u8d39\u8005\u5747\u80fd\u517c\u5bb9 3.0.7\uff0c\u4e14\u4e0d\u5b58\u5728 `invalid` \u6216 peer dependency \u95ee\u9898 |\n| \u79c1\u6709\u6e90\u53ef\u7528\u6027 | \u9501\u6587\u4ef6\u4e0b\u8f7d\u5730\u5740\u6307\u5411 Azure DevOps \u79c1\u6709 npm feed | CI \u548c\u7ef4\u62a4\u8005\u9a8c\u8bc1\u9700\u8981\u6709\u6548\u8ba4\u8bc1\uff1b\u65e0\u51ed\u636e\u73af\u5883\u53ef\u80fd\u65e0\u6cd5\u91cd\u73b0\u5b89\u88c5 |\n| \u9501\u6587\u4ef6\u5143\u6570\u636e\u53d8\u5316 | \u591a\u4e2a\u53ef\u9009\u5305\u65b0\u589e `dev: true`\uff0c\u53ef\u80fd\u6539\u53d8 production-only \u5b89\u88c5\u65f6\u7684\u4fdd\u7559/\u88c1\u526a\u7ed3\u679c | \u5982\u8be5\u793a\u4f8b\u6709\u751f\u4ea7\u6a21\u5f0f\u6253\u5305\u6216 `npm ci --omit=dev` \u6d41\u7a0b\uff0c\u5e94\u6bd4\u8f83\u5b89\u88c5\u4e0e\u6784\u5efa\u4ea7\u7269 |\n| \u7cbe\u786e\u56fa\u5b9a\u7684\u7ef4\u62a4\u6210\u672c | \u7cbe\u786e\u7248\u672c\u4e0d\u4f1a\u81ea\u52a8\u83b7\u53d6\u672a\u6765\u8865\u4e01 | \u540e\u7eed\u4ecd\u9700\u4f9d\u8d56\u66f4\u65b0\u6216\u5b89\u5168\u81ea\u52a8\u5316\u6301\u7eed\u68c0\u67e5\u65b0\u6f0f\u6d1e |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\nPR \u63cf\u8ff0\u4e2d\u8bb0\u5f55\u7684\u81ea\u52a8\u9a8c\u8bc1\u7ed3\u679c\u5982\u4e0b\uff1b\u8fd9\u4e9b\u662f\u5206\u6790\u5305\u63d0\u4f9b\u7684\u62a5\u544a\uff0c\u4e0d\u662f\u672c\u6b21\u8bf4\u660e\u72ec\u7acb\u6267\u884c\u6240\u5f97\uff1a\n\n- **S1 \u8b66\u62a5\u6709\u6548\u6027\uff1aPASS**\uff0c\u62a5\u544a\u79f0\u7ec4\u4ef6\u3001\u7248\u672c\u548c\u6f0f\u6d1e\u5206\u7c7b\u4e0e\u8b66\u62a5 14745743 \u4e00\u81f4\u3002\n- **S2 \u8bed\u4e49\u6b63\u786e\u6027\uff1aPASS**\uff0c\u62a5\u544a\u79f0\u7cbe\u786e `overrides` \u53ef\u88ab\u8bc6\u522b\uff0c\u7248\u672c\u7531 `3.0.5` \u5347\u81f3 `3.0.7`\uff0c\u4e14\u672a\u53d1\u751f\u964d\u7ea7\u3002\n- **S3 \u6784\u5efa\u4e0e\u6d4b\u8bd5\uff1aENV_BLOCKED**\uff0c\u7531\u4e8e\u79c1\u6709 npm feed \u8ba4\u8bc1\u9650\u5236\uff0c\u9a8c\u8bc1\u5668\u73af\u5883\u6ca1\u6709\u6267\u884c\u6784\u5efa\u3002\n- **S4 \u7ec4\u4ef6\u68c0\u6d4b\uff1aSKIPPED**\uff0c\u73af\u5883\u4e2d\u6ca1\u6709\u53ef\u7528\u7684 Component Detection CLI\u3002\n\n\u56e0\u6b64\uff0c\u5305\u5185\u6ca1\u6709\u53ef\u8bc1\u660e\u5b9e\u9645 `npm ci`\u3001Angular \u6784\u5efa\u3001\u5355\u5143\u6d4b\u8bd5\u6216\u5f00\u53d1\u670d\u52a1\u5668\u4ee3\u7406\u6d4b\u8bd5\u5df2\u6210\u529f\u7684\u7ed3\u679c\u3002\u5408\u5e76\u524d\u6700\u91cd\u8981\u7684\u8865\u5145\u9a8c\u8bc1\u662f\uff1a\u5728\u53ef\u8bbf\u95ee\u79c1\u6709 feed \u7684 CI \u73af\u5883\u6267\u884c\u786e\u5b9a\u6027\u5b89\u88c5\u548c\u73b0\u6709\u6784\u5efa/\u6d4b\u8bd5\uff0c\u5e76\u9a8c\u8bc1\u4f9d\u8d56\u6811\u53ea\u5305\u542b\u9884\u671f\u7684 `http-proxy-middleware@3.0.7`\u3002\n\n## \u5dee\u5f02\u8986\u76d6\u8303\u56f4\n\n\u5206\u6790\u5305\u58f0\u660e\u5171\u6709 2 \u4e2a\u53d8\u66f4\u6587\u4ef6\uff0c\u5e76\u63d0\u4f9b\u4e86\u8fd9\u4e24\u4e2a\u6587\u4ef6\u7684\u5dee\u5f02\uff1a\n\n- [`sample/angular-host-app/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766461?path=/sample/angular-host-app/package.json&_a=files)\n- [`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766461?path=/sample/angular-host-app/package-lock.json&_a=files)\n\n\u5305\u7ea7 `diffTruncated` \u4e3a `false`\uff0c\u4e24\u4e2a\u6587\u4ef6\u5404\u81ea\u7684 `truncated` \u4e5f\u5747\u4e3a `false`\uff0c\u4e14\u5305\u4e2d\u6ca1\u6709\u5bfc\u51fa\u9519\u8bef\u6216\u8b66\u544a\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5206\u6790\u5305\u6240\u63d0\u4f9b\u7684\u5168\u90e8\u6587\u4ef6\u5dee\u5f02\uff1b\u4f46\u5b83\u4e0d\u4ee3\u8868\u5bf9\u4ed3\u5e93\u5176\u4ed6\u672a\u53d8\u66f4\u6587\u4ef6\u3001\u5916\u90e8\u6f0f\u6d1e\u516c\u544a\u6b63\u6587\u3001\u4e0a\u6e38\u5305\u6e90\u7801\u6216\u672a\u5305\u542b\u7684 CI \u65e5\u5fd7\u8fdb\u884c\u4e86\u5206\u6790\u3002\n", "creation_timestamp": "2026-08-31T16:03:27.415212Z"}]}