[서버 실행하기] 의존성 설치를 위한 npm install 시 취약점 발생

• 초기 설치 시 취약점 발생

  • ```
    npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.

    npm warn deprecated @humanwhocodes/config-array@0.11.14: Use @eslint/config-array instead

    npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported

    npm warn deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead

    npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

    npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

    npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

    npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

    npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

    npm warn deprecated superagent@8.1.2: Please upgrade to v9.0.0+ as we have fixed a public vulnerability with formidable dependency. Note that v9.0.0+ requires Node.js v14.18.0+. See https://github.com/ladjs/superagent/pull/1800 for insight. This project is supported and maintained by the team at Forward Email @ https://forwardemail.net

    added 795 packages, and audited 796 packages in 7s

    122 packages are looking for funding

    run npm fund for details

    18 vulnerabilities (4 low, 5 moderate, 9 high)

    To address issues that do not require attention, run:

    npm audit fix

    To address all issues (including breaking changes), run:

    npm audit fix --force

    Run npm audit for details.
    ```

• 이후 ```npm audit fix``` 실행 후 두 번째 취약점 발생

  • ```
    # npm audit report

    multer 1.4.4-lts.1 - 2.0.0

    Severity: high

    Multer vulnerable to Denial of Service via unhandled exception - https://github.com/advisories/GHSA-g5hg-p3ph-g8qg

    fix available via npm audit fix --force

    Will install @nestjs/platform-express@8.2.3, which is a breaking change

    node_modules/multer

    @nestjs/platform-express >=8.2.4

    Depends on vulnerable versions of @nestjs/core

    Depends on vulnerable versions of multer

    node_modules/@nestjs/platform-express

    @nestjs/core >=9.0.0-next.1

    Depends on vulnerable versions of @nestjs/platform-express

    node_modules/@nestjs/core

    @nestjs/serve-static 2.0.0-next.1 - 2.0.0 || >=3.0.0

    Depends on vulnerable versions of @nestjs/core

    Depends on vulnerable versions of path-to-regexp

    node_modules/@nestjs/serve-static

    @nestjs/testing >=9.0.0-next.1

    Depends on vulnerable versions of @nestjs/core

    Depends on vulnerable versions of @nestjs/platform-express

    node_modules/@nestjs/testing

    path-to-regexp 0.2.0 - 1.8.0

    Severity: high

    path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j

    fix available via npm audit fix --force

    Will install @nestjs/serve-static@5.0.3, which is a breaking change

    node_modules/@nestjs/serve-static/node_modules/path-to-regexp

    6 high severity vulnerabilities

    To address all issues (including breaking changes), run:

    npm audit fix --force
    ```

• 취약점 6개 발생 이후 안사라지길래 npm audit fix --force 진행해도 6개 그대로 나오는 현상 발생

현재 node 23.7, npm 10.9.2 사용중인데 gpt한테 물어보니 nest js 버전 어쩌구 하던데 서버는 잘 몰라서 건들지를 못하겠네요. 어떻게 해야 할까요?

❗질문 작성시 꼭 참고해주세요

• 에러 메세지에서 단서를 찾을 수 있는 경우가 많습니다. 에러 메세지를 읽고 한번 검색해보시는것을 추천드립니다.

• 질문글을 작성하실때는, 현재 문제(또는 에러)와 코드나 github을 첨부해주세요.

• 개발중인 OS, ReactNative, Node 버전 등의 개발환경을 알려주셔야합니다.

• 에러메세지는 일부분이 아닌 전체 상황을 올려주세요. 일부만 보여주시면 답변이 어렵습니다.

• 에러 잘라서 올리시면 안됩니다!

(에러 일부만 자르거나 일부만 복사하지말아주세요)