Security: Fix CVE-2023-26115 (word-wrap ReDoS)

[vmrh21]

Date: 2026-02-26

Summary

This PR fixes CVE-2023-26115 by adding npm override for word-wrap ^1.2.5. This forces all transitive dependencies to use the patched version, resolving a Regular Expression Denial of Service (ReDoS) vulnerability.

CVE Details

• CVE ID: CVE-2023-26115
• Package: word-wrap
• Severity: Moderate (CVSS 5.3)
• Impact: Regular Expression Denial of Service (ReDoS)
• Vulnerable versions: < 1.2.5
• Fixed version: 1.2.5
• Jira Issues: RHOAIENG-427

Fix Method

Used npm overrides field (recommended approach for this monorepo):

{
  "overrides": {
    "word-wrap": "^1.2.5"
  }
}

Files Changed (4 total)

• package.json (added overrides)
• package-lock.json
• backend/package-lock.json
• frontend/package-lock.json

Test Results ✅

Status: All tests passed
Test command: npm test
Duration: 44s

Test Summary

• Test Suites: 4 passed, 4 total
• Tests: 30 passed, 30 total
• Backend: PASSED
• Frontend: PASSED (lint + jest + type-check)

Breaking Changes

None - word-wrap 1.2.5 is a pure security patch with no API changes.

Verification

Before:

word-wrap@1.2.3 (vulnerable)

After:

word-wrap@1.2.5 overridden
CVE-2023-26115 no longer in npm audit

Testing Checklist

• Pre-PR automated tests executed and passed
• Verified word-wrap@1.2.5 with npm list word-wrap
• Verified CVE resolved with npm audit
• All monorepo lock files updated (root, backend, frontend)
• Review no unexpected formatting changes in production

Risk Assessment

Category	Risk Level	Notes
Breaking Changes	None	Pure security patch
Dependency Conflicts	Low	No conflicts detected
Rollback Complexity	Low	Simple revert

---

🤖 Generated by CVE Fixer Workflow

[vmrh21]

Closing for fresh test run