ROOT-APP-NPM-CVE-2026-73231 CVE-2026-73231 in @faker-js/faker - Patched by Root

Root has patched CVE-2026-73231 in the @faker-js/faker package for Root:npm. Multiple fixed versions available...

@depup/artillery (>=2.0.33-depup.28, <=2.0.33-depup.50), @eduzz/e2e-playwright-base (0.4.0) +78 more potentially affected by CVE-2026-73231 via @faker-js/faker (>=10.0.0, <=10.4.0)

@faker-js/faker NPM version =10.0.0, =2.0.33-depup.28, =19.8.4, =1.0.7, =3.1.2, =0.2.9, =0.4.7, =0.2.12, =1.0.5, =0.2.10, =0.3.2, =0.2.13, =0.2.16, =0.6.1, =0.6.5 and more Source cves: CVE-2026-73231 Source advisory: OSV:GHSA-QXC2-J82W-R537...

@depup/artillery (>=2.0.33-depup.28, <=2.0.33-depup.50), @eduzz/e2e-playwright-base (0.4.0) +78 more potentially affected by CVE-2026-73231 via @faker-js/faker (>=10.0.0, <=10.4.0)

@faker-js/faker NPM version =10.0.0, =2.0.33-depup.28, =19.8.4, =1.0.7, =3.1.2, =0.2.9, =0.4.7, =0.2.12, =1.0.5, =0.2.10, =0.3.2, =0.2.13, =0.2.16, =0.6.1, =0.6.5 and more Source cves: CVE-2026-73231 Source advisory: GHSA-QXC2-J82W-R537...

Eval Injection

Overview @faker-js/faker is a Generate massive amounts of fake contextual data Affected versions of this package are vulnerable to Eval Injection via the helpers.fake function. An attacker can execute arbitrary JavaScript code by supplying specially crafted templates that access the Function...

@depup/artillery (>=2.0.33-depup.28, <=2.0.33-depup.50), @eduzz/e2e-playwright-base (0.4.0) +78 more potentially affected by CVE-2026-73231 via @faker-js/faker (>=10.0.0, <=10.4.0)

@faker-js/faker NPM version =10.0.0, =2.0.33-depup.28, =19.8.4, =1.0.7, =3.1.2, =0.2.9, =0.4.7, =0.2.12, =1.0.5, =0.2.10, =0.3.2, =0.2.13, =0.2.16, =0.6.1, =0.6.5 and more Source cves: CVE-2026-73231 Source advisory: SNYK:JS-FAKERJSFAKER-18674671...

116zm_atm (1.0.0), 11_oopmybank (1.0.4) +3048 more potentially affected by CVE-2026-73231 via @faker-js/faker (>=5.5.3, <=10.4.0)

@faker-js/faker NPM version =5.5.3, =1.0.0, =0.1.0, =5.1.3, =2.7.0, =1.0.0, =7.8.0, =0.0.1, =1.0.0 and more Source cves: CVE-2026-73231 Source advisory: MEND:CVE-2026-73231...

GHSA-5W9C-RV96-FR7G Removal of functional code in faker.js

Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to be a purposeful and successful attempt to make the package unusable. This is related to the colors.js CVE-2021-23567. The...