CVE-2024-55565

Advisory

Langfuse has updated the nanoid dependency to version 3.3.8 across multiple package.json files to address a security vulnerability identified as CVE-2024-55565.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed

Features

* feat: add CLICKHOUSE_DB env support by peske in https://github.com/langfuse/langfuse/pull/4911. See [docs](https://langfuse.com/self-hosting/infrastructure/clickhouse#configuration) for all details.

Fixes

* fix(models): allow string tokenizer config by hassiebp in https://github.com/langfuse/langfuse/pull/4898
* fix: do not error on 403 by model provider for eval executions by maxdeichmann in https://github.com/langfuse/langfuse/pull/4905

Security

* security: upgrade nanoid by maxdeichmann in https://github.com/langfuse/langfuse/pull/4909
* security: prevent prototype pollution in dataset compare view by maxdeichmann in https://github.com/langfuse/langfuse/pull/4910

Chores

* chore: move sessions, traces, comments router logs to logger by Steffen911 in https://github.com/langfuse/langfuse/pull/4902
* chore(media): increase rate-limit to use ingestion budget by hassiebp in https://github.com/langfuse/langfuse/pull/4907

**Full Changelog**: https://github.com/langfuse/langfuse/compare/v3.5.3...v3.6.0

Resources

• https://github.com/langfuse/langfuse/pull/4909
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55565