# Bump sha.js dependency to fix a vulnerability

**URL:** <https://community.apollographql.com/t/bump-sha-js-dependency-to-fix-a-vulnerability/9400>\
**Category:** Other Apollo Topics\
**Tags:** security-notice\
**Created:** [August 22, 2025, 9:20am UTC](https://community.apollographql.com/t/bump-sha-js-dependency-to-fix-a-vulnerability/9400 "2025-08-22T09:20:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![constantin-me](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/constantin-me/32/6331_2.png) [@constantin-me](https://community.apollographql.com/u/constantin-me)\
**Post date:** [August 22, 2025, 9:20am UTC](https://community.apollographql.com/t/bump-sha-js-dependency-to-fix-a-vulnerability/9400/1 "2025-08-22T09:20:38Z")

</div>

Hey there Apollo Community 👋

There’s an a vulnerable dependency in the [@apollo/utils.createhash - npm](https://www.npmjs.com/package/@apollo/utils.createhash) package.

It uses sha.js@2.4.11 which is vulnerable report here: [sha.js is missing type checks leading to hash rewind and passing on crafted data · CVE-2025-9288 · GitHub Advisory Database · GitHub](https://github.com/advisories/GHSA-95m3-7q98-8xr5)

A fix is available by updating the sha.js dependency.

I’ve tried opening a PR, but well I was denied.

```bash
ERROR: Permission to apollographql/apollo-utils.git denied to constantin-melniciuc.
fatal: Could not read from remote repository.

```

```bash
Please make sure you have the correct access rightsand the repository exists.

```

To solve this locally for us, we just bumped the sha.js version in our own repository, but it’d be nice if this would come up fixed.

Thank you for your time.

Constantin

---

<div class="post-metadata">

**Author:** ![lenz](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/lenz/32/4007_2.png) [@lenz](https://community.apollographql.com/u/lenz)\
**Post date:** [August 22, 2025, 1:04pm UTC](https://community.apollographql.com/t/bump-sha-js-dependency-to-fix-a-vulnerability/9400/2 "2025-08-22T13:04:20Z")

</div>

I believe there’s no need for action here - that package has a dependency on `^2.4.11`, not `2.4.11` - that means “anything in the range `>=2.4.11 <3.0.0`”.

Your package manager should be able to update to 2.4.12 just fine, and any future installation of `@apollo/utils.createhash` will end up using the latest, non-vulnerable version.

---

<div class="post-metadata">

**Author:** ![constantin-me](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/constantin-me/32/6331_2.png) [@constantin-me](https://community.apollographql.com/u/constantin-me)\
**Post date:** [August 25, 2025, 8:22am UTC](https://community.apollographql.com/t/bump-sha-js-dependency-to-fix-a-vulnerability/9400/3 "2025-08-25T08:22:20Z")

</div>

Sure, overrides work as well, but `npm audit` shows the apollo packages as critical vulnerability.

I’d say this is a must upgrade.

Thanks.

---

<div class="post-metadata">

**Author:** ![lenz](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/lenz/32/4007_2.png) [@lenz](https://community.apollographql.com/u/lenz)\
**Post date:** [August 25, 2025, 11:10am UTC](https://community.apollographql.com/t/bump-sha-js-dependency-to-fix-a-vulnerability/9400/4 "2025-08-25T11:10:31Z")

</div>

I just created a new project with this `package.json`

```json
{
  "name": "test",
  "dependencies": {
    "@apollo/utils.createhash": "^3.0.1"
  }
}

```

Running the commands:

```bash
% npm i

added 32 packages, and audited 33 packages in 777ms

16 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

```

```bash
% npm audit
found 0 vulnerabilities

```

```bash
% npm why sha.js
sha.js@2.4.12
node_modules/sha.js
  sha.js@"^2.4.11" from @apollo/utils.createhash@3.0.1
  node_modules/@apollo/utils.createhash
    @apollo/utils.createhash@"^3.0.1" from the root project

```

```bash
% npm ls sha.js
test@ /tmp/test
└─┬ @apollo/utils.createhash@3.0.1
  └── sha.js@2.4.12

```

Npm behaves as expected, does not install the vulnerable version, and `npm audit` seems to take that on correctly.

Did you run `npm update` or `npm update sha.js` on your end before running `npm audit`?

---

<div class="post-metadata">

**Author:** ![constantin-me](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/constantin-me/32/6331_2.png) [@constantin-me](https://community.apollographql.com/u/constantin-me)\
**Post date:** [August 25, 2025, 12:06pm UTC](https://community.apollographql.com/t/bump-sha-js-dependency-to-fix-a-vulnerability/9400/5 "2025-08-25T12:06:13Z")

</div>

Hm… I did not do that. Didn’t know about it tbh. 🤷‍♂️

Thank you for the suggestion.