Security: Fix CVE-2023-26115 (word-wrap ReDoS)

[vmrh21]

Date: 2026-02-26

Summary

This PR fixes CVE-2023-26115 (word-wrap ReDoS vulnerability) by adding npm override to force word-wrap ^1.2.5 across all transitive dependencies.

CVE Details

• CVE ID: CVE-2023-26115
• Package: word-wrap
• Severity: MODERATE (CVSS 5.3)
• Vulnerability: Regular Expression Denial of Service (ReDoS)
• Impact: Attackers can cause DoS via crafted inputs triggering exponential regex backtracking
• Vulnerable versions: <1.2.4
• Fixed version: 1.2.5
• Jira Issues: RHOAIENG-427

Test Results ✅

Status: All tests passed
Test Framework: npm scripts (run-s test:backend test:frontend)
Test command: npm test
Exit code: 0
Duration: <10 minutes

Test Summary

• Backend tests: ✅ PASSED
• Frontend tests: ✅ PASSED
• Regressions: None detected

Fix Method

Approach: npm overrides (recommended for transitive dependencies)

• word-wrap is a transitive dependency (optionator → escodegen → jsdom)
• Single override in root package.json forces all instances to use fixed version
• Follows repository best practices from .cve-fix/examples.md

Files Changed (4 total):

• package.json (added override)
• package-lock.json
• backend/package-lock.json
• frontend/package-lock.json

Breaking Changes

None - pure security patch with no API changes

• word-wrap 1.2.5 is backward compatible
• No application code changes required
• All consuming packages remain compatible

Testing Checklist

• Pre-PR automated tests executed and passed
• Verified word-wrap@1.2.5 via npm list
• Confirmed CVE no longer in npm audit
• All monorepo lock files updated (root, backend, frontend)
• Build succeeds in CI/CD pipeline
• Smoke test dashboard functionality

Risk Assessment

Risk Factor	Level	Notes
Breaking Changes	LOW	Pure security patch, no API changes
Dependency Conflicts	LOW	Compatible with all transitive deps
Regression Risk	LOW	All tests passed, no code changes
Deployment Impact	LOW	Standard dependency update

Overall Risk: LOW

Verification Steps

1. Verify CVE is resolved:

   npm audit | grep word-wrap
   # Expected: (empty - CVE resolved)

2. Verify version:

   npm list word-wrap
   # Expected: word-wrap@1.2.5 overridden

3. Run tests:

   npm test
   # Expected: All tests pass

---

🤖 Generated by CVE Fixer Workflow
📋 Fix implementation report: artifacts/cve-fixer/fixes/fix-implementation-CVE-2023-26115.md

[vmrh21]

Closing for fresh test run