NPM dependency vulnerability (moderate)—react-email >=3.0.4 depends on vulnerable versions of next

[danielgwilson]

Describe the Bug

Getting a dependency bug currently

**# npm audit report**

**next**  15.0.0 - 15.1.1
Severity: **moderate**
**Next.js Allows a Denial of Service (DoS) with Server Actions** - https://github.com/advisories/GHSA-7m27-7ghc-44w9
**fix available** via `npm audit fix`
node_modules/react-email/node_modules/next
  **react-email**  >=3.0.4
  Depends on vulnerable versions of next
  node_modules/react-email

Which package is affected (leave empty if unsure)

No response

Link to the code that reproduces this issue

npm i

To Reproduce

Install package with Next 15

Expected Behavior

No vulnerability warnings

What's your node version? (if relevant)

22.12.0

[danielgwilson]

(With npm 11.0.0)

[javirln]

I was going to report the same thanks @danielgwilson!

It seems the affected CVE is the following: https://nvd.nist.gov/vuln/detail/CVE-2024-56332

[apergy]

Look like we need this to pass and then release be5c48d.

[gabrielmfern]

Just released a new stable version with this fixed! react-email@3.0.5.