Critical vulnerabilities

[jaceks2106foss]

Hi,

This package contains a lot of vulnerabilities, including 6 critical. Our project rules forbid from using this package anymore, because of that. Is there any plan for major updates?

https://github.com/postmanlabs/newman/actions/runs/19610844030/job/56156412329

[Neelabhra08]

@jaceks2106foss We are also facing the same issue with this. I request to take immediate action on this.

[james-doof-ww]

reporting the same please resolve

[YLbreeze]

same issue, resolve this pls

[saecula]

Hey @jaceks2106foss, we're working on an upgrade to resolve vulnerabilities in Newman and will post updates here.

[saecula]

We've published Newman version 6.2.2 addressing the major vulnerabilities; @jaceks2106foss can you pull the latest version and confirm whether you are unblocked?

[henrychv]

It is not fixed, as npm overrides does not work for transitive dependencies
E.g. override of postman-request@2.88.1-postman.48 vs postman-runtime@7.39.1 which includes postman-request@2.88.1-postman.34 which is not overriden.

Same for qs and node-forge, which are also in postman-runtime.

So scanners and npm audit still see vulnerable versions included in docker image when newman@6.2.2 is used. Fix need to be with proper update of dependencies in postman-request and postman-runtime, not by overrides in newman.

To test I created empty app just with package.json with newman@6.2.2 as dependency inside docker node:20 container:

npm ls -depth 4 | grep "newman\|postman-request\|postman-runtime\|forge\|qs"
`-- newman@6.2.2
  +-- postman-request@2.88.1-postman.48
  | +-- qs@6.14.1
  +-- postman-runtime@7.39.1
  | +-- node-forge@1.3.1
  | +-- postman-request@2.88.1-postman.34
  | | +-- qs@6.5.3

and

npm audit
# npm audit report

jose  3.0.0 - 4.15.4
Severity: moderate
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - https://github.com/advisories/GHSA-hhhv-q57g-882q
fix available via `npm audit fix --force`
Will install newman@6.2.0, which is a breaking change
node_modules/jose
  postman-runtime  >=2.4.3
  Depends on vulnerable versions of jose
  Depends on vulnerable versions of node-forge
  Depends on vulnerable versions of postman-request
  node_modules/postman-runtime
    newman  >=3.1.0-beta.1
    Depends on vulnerable versions of postman-request
    Depends on vulnerable versions of postman-runtime
    node_modules/newman

node-forge  <=1.3.1
Severity: high
node-forge has ASN.1 Unbounded Recursion - https://github.com/advisories/GHSA-554w-wpv2-vw27
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization - https://github.com/advisories/GHSA-5gfm-wpxj-wjgq
node-forge is vulnerable to ASN.1 OID Integer Truncation - https://github.com/advisories/GHSA-65ch-62r8-g69g
fix available via `npm audit fix --force`
Will install newman@6.2.0, which is a breaking change
node_modules/node-forge

qs  <6.14.1
Severity: high
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p
fix available via `npm audit fix --force`
Will install newman@6.2.0, which is a breaking change
node_modules/postman-runtime/node_modules/qs
  postman-request  *
  Depends on vulnerable versions of qs
  node_modules/postman-request
  node_modules/postman-runtime/node_modules/postman-request

6 vulnerabilities (1 moderate, 5 high)

[juanitosvq]

Yeah, so I think we need this in:
postmanlabs/postman-runtime#1541

Then newman should be updated to use that new version of postman-runtime (it's already using the latest version of postman-request which should have everything we need patched).

[hervekom37]

Newman dependency issues like these highlight the challenge of keeping transitive dependencies secure. Some teams have moved to Apidog, which offers a Linux/Windows client with all-in-one API testing and avoids these old vulnerabilities.