Repository navigation
Security Vulnerabilities in "uuid" & "fast-xml-parser" transitive dependencies for @google-cloud/storage latest version 7.19.0 #8134
Description
Please make sure you have searched for information in the following guides.
- Search the issues already opened: https://github.com/GoogleCloudPlatform/google-cloud-node/issues
- Search StackOverflow: http://stackoverflow.com/questions/tagged/google-cloud-platform+node.js
- Check our Troubleshooting guide: https://github.com/googleapis/google-cloud-node/blob/main/docs/troubleshooting.md
- Check our FAQ: https://github.com/googleapis/google-cloud-node/blob/main/docs/faq.md
- Check our libraries HOW-TO: https://github.com/googleapis/gax-nodejs/blob/main/client-libraries.md
- Check out our authentication guide: https://github.com/googleapis/google-auth-library-nodejs
- Check out handwritten samples for many of our APIs: https://github.com/GoogleCloudPlatform/nodejs-docs-samples
- Check the API's issue tracker: https://cloud.google.com/support/docs/issue-trackers
Library Name
@google-cloud/storage
A screenshot that you have tested with "Try this API".
Not applicable to this bug
Link to the code that reproduces this issue. A link to a public Github Repository or gist with a minimal reproduction.
https://github.com/googleapis/google-cloud-node
A step-by-step description of how to reproduce the issue, based on the linked reproduction.
There are security vulnerabilities in the "uuid" and "fast-xml-parser" transitive dependencies used by @google-cloud/storage v7.19.0 which we discovered when running the "npm audit" command in node.js
Please refer to these links for reference:
GHSA-gh4j-gqv2-49f6
GHSA-w5hq-g745-h8pq
Running "npm ls fast-xml-parser" shows this:
└─┬ @google-cloud/storage@7.19.0
└── fast-xml-parser@5.6.0
Running "npm ls uuid" shows this:
@google-cloud/storage@7.19.0
├─┬ gaxios@6.7.1
│ └── uuid@9.0.1
├─┬ google-auth-library@9.15.1
│ └─┬ gtoken@7.1.0
│ └─┬ gaxios@6.7.1
│ └── uuid@9.0.1
├─┬ teeny-request@9.0.0
│ └── uuid@9.0.1
└── uuid@8.3.2
Please advise if there are any plans to fix this vulnerability in @google-cloud/storage, or how we can handle it.
Thank you.
A clear and concise description of what the bug is, and what you expected to happen.
There are security vulnerabilities in the "uuid" and "fast-xml-parser" transitive dependencies used by @google-cloud/storage v7.19.0 which we discovered when running the "npm audit" command in node.js
Please refer to these links for reference:
GHSA-gh4j-gqv2-49f6
GHSA-w5hq-g745-h8pq
Running "npm ls fast-xml-parser" shows this:
└─┬ @google-cloud/storage@7.19.0
└── fast-xml-parser@5.6.0
Running "npm ls uuid" shows this:
@google-cloud/storage@7.19.0
├─┬ gaxios@6.7.1
│ └── uuid@9.0.1
├─┬ google-auth-library@9.15.1
│ └─┬ gtoken@7.1.0
│ └─┬ gaxios@6.7.1
│ └── uuid@9.0.1
├─┬ teeny-request@9.0.0
│ └── uuid@9.0.1
└── uuid@8.3.2
Please advise if there are any plans to fix this vulnerability in @google-cloud/storage, or how we can handle it.
Thank you.
A clear and concise description WHY you expect this behavior, i.e., was it a recent change, there is documentation that points to this behavior, etc. **
There are security vulnerabilities in the "uuid" and "fast-xml-parser" transitive dependencies used by @google-cloud/storage v7.19.0 which we discovered when running the "npm audit" command in node.js
Please refer to these links for reference:
GHSA-gh4j-gqv2-49f6
GHSA-w5hq-g745-h8pq
Running "npm ls fast-xml-parser" shows this:
└─┬ @google-cloud/storage@7.19.0
└── fast-xml-parser@5.6.0
Running "npm ls uuid" shows this:
@google-cloud/storage@7.19.0
├─┬ gaxios@6.7.1
│ └── uuid@9.0.1
├─┬ google-auth-library@9.15.1
│ └─┬ gtoken@7.1.0
│ └─┬ gaxios@6.7.1
│ └── uuid@9.0.1
├─┬ teeny-request@9.0.0
│ └── uuid@9.0.1
└── uuid@8.3.2
Please advise if there are any plans to fix this vulnerability in @google-cloud/storage, or how we can handle it.
Thank you.
Activity
meltsufin commentedon May 5, 2026
@ShreyasSinha PTAL
mhassan1 commentedon May 5, 2026
I've put up a PR to remove the
uuiddependency (link).meltsufin commentedon May 6, 2026
I believe we can just update to version
11.1.1which has been patched. There's no need to remove the dependency onuuid.orien commentedon May 12, 2026
To resolve the security issue on
uuid, we'll need to do the following (and perhaps more).Bump
uuidto^11(or higher) in@google-cloud/storage,@google-cloud/bigtable,@google-cloud/logging,@google-cloud/logging-bunyan, and@google-cloud/error-reporting.@google-cloud/storagegoogle-cloud-node/handwritten/storage/package.json
Line 93 in 92b328b
@google-cloud/bigtablegoogle-cloud-node/handwritten/bigtable/package.json
Line 112 in 92b328b
@google-cloud/logginggoogle-cloud-node/handwritten/logging/package.json
Line 69 in 92b328b
@google-cloud/logging-bunyangoogle-cloud-node/handwritten/logging-bunyan/package.json
Line 85 in 92b328b
@google-cloud/error-reportinggoogle-cloud-node/handwritten/error-reporting/package.json
Line 71 in 92b328b
Bump
gaxiosto^7in@google-cloud/storagegoogle-cloud-node/handwritten/storage/package.json
Line 86 in 92b328b
Bump
retry-requestto^8in@google-cloud/storagegoogle-cloud-node/handwritten/storage/package.json
Line 91 in 92b328b
Bump
google-auth-libraryto^10in@google-cloud/storage,@google-cloud/logging, and@google-cloud/logging-bunyan.@google-cloud/storagegoogle-cloud-node/handwritten/storage/package.json
Line 87 in 92b328b
@google-cloud/logginggoogle-cloud-node/handwritten/logging/package.json
Line 63 in 92b328b
@google-cloud/logging-bunyangoogle-cloud-node/handwritten/logging-bunyan/package.json
Line 59 in 92b328b
Bump
teeny-requestto^10in@google-cloud/storageand@google-cloud/cloud-profiler@google-cloud/storagegoogle-cloud-node/handwritten/storage/package.json
Line 92 in 92b328b
@google-cloud/cloud-profilergoogle-cloud-node/handwritten/cloud-profiler/package.json
Line 48 in 92b328b
fix(functions): pin uuid to 11.1.1 via override to resolve CVE-2026-4…
habeeb-mir commentedon Jul 9, 2026
Hi, has there been any update on this?
@shivanee-p @aabmass @pearigee @danieljbruce
balintsoos commentedon Aug 13, 2026
Hi, we are currently working around this issue by pinning
uuidvia a dependency override on our end for@google-cloud/storage. Do you have a rough estimate for when a proper fix will ship so we can plan when to remove the override? Thanks!