# NPM audit results

**URL:** <https://community.hubspot.com/t/npm-audit-results/162256>\
**Category:** Develop, Build & Integrate\
**Tags:** local-development\
**Created:** [October 17, 2026, 4:06pm UTC](https://community.hubspot.com/t/npm-audit-results/162256 "2026-10-17T16:06:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![GThulasiraman](https://avatars.discourse-cdn.com/v4/letter/g/e56c9b/32.png) [@GThulasiraman](https://community.hubspot.com/u/GThulasiraman)\
**Post date:** [October 17, 2026, 4:06pm UTC](https://community.hubspot.com/t/npm-audit-results/162256/1 "2026-10-17T16:06:29Z")

</div>

My root project’s npm audit currently reports 8 high-severity findings, all associated with this underlying advisory:

braces: stack-exhaustion denial of service through deeply nested patterns  
[https://github.com/advisories/GHSA-vfj7-8cjw-p6xm](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm)

The installed version is [braces@3.0.3](mailto:braces@3.0.3), pulled in through:

Chokidar 3.6.0, required by the CLI and its local development libraries.  
Micromatch 4.0.8, required through findup-sync.  
When checked, the npm registry reported 3.0.3 as the latest braces release, and the advisory listed no patched version. Had anyone faced this issue before and how did you fix it?

---

<div class="post-metadata">

**Author:** ![GThulasiraman](https://avatars.discourse-cdn.com/v4/letter/g/e56c9b/32.png) [@GThulasiraman](https://community.hubspot.com/u/GThulasiraman)\
**Post date:** [October 18, 2026, 8:27pm UTC](https://community.hubspot.com/t/npm-audit-results/162256/3 "2026-10-18T20:27:18Z")

</div>

Thank you @CanerKaya for explaining this. I checked my project and found:

- `npm ls braces` shows `braces@3.0.3` coming through `@hubspot/cli@8.16.0`, via Chokidar and via Micromatch/Findup-sync.
- The CLI is now in the root project’s `devDependencies`, and running `npm audit --omit=dev` at the root reports **0 vulnerabilities**.
- My card and serverless functions have separate packages; their audits also reported 0 vulnerabilities when checked earlier.
- A targeted search of my JavaScript and TypeScript source under `src`, excluding `node_modules`, found no references to `micromatch`, `braces`, `minimatch`, `fast-glob`, `glob(`, or `globSync`. I understand this is not a complete security review.

I have not added a `braces` override or used `npm audit fix --force`. Eight high-severity findings remain in the root audit, tracing back to the `braces` advisory.

For transparency, I previously added six overrides scoped under the CLI for other findings: `@modelcontextprotocol/sdk`, `axios`, `js-yaml`, `moment`, `qs`, and `@sentry/node`. CLI version checks, sandbox upload/build/deployment, and product loading/submission tests passed, but I haven’t validated every CLI feature.

Given these results, is monitoring the advisory and waiting for a supported CLI update the appropriate interim approach? Are there additional checks you recommend for user-controlled patterns reaching these libraries indirectly? Also, should the six unrelated overrides be reviewed separately with HubSpot Support?

---

<div class="post-metadata">

**Author:** ![GThulasiraman](https://avatars.discourse-cdn.com/v4/letter/g/e56c9b/32.png) [@GThulasiraman](https://community.hubspot.com/u/GThulasiraman)\
**Post date:** [October 19, 2026, 12:53pm UTC](https://community.hubspot.com/t/npm-audit-results/162256/5 "2026-10-19T12:53:22Z")

</div>

Thank you so much @CanerKaya for your valuable input on this issue. Appreciate it!