[GH-ISSUE #475] Pin Rollup to >=4.59.0 for CVE-2026-27606 #106

New issue

Closed

opened 2026-05-06 12:37:15 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:37:15 +02:00

Owner

Originally created by @Divkix on GitHub (Mar 11, 2026).
Original GitHub issue: https://github.com/cloudflare/vinext/issues/475

Summary

The repo currently resolves rollup@4.57.1 in the workspace lockfile, which is affected by CVE-2026-27606 / GHSA-mw96-cpmx-2vgc.

GitHub Advisory: https://github.com/advisories/GHSA-mw96-cpmx-2vgc
OSV: https://osv.dev/vulnerability/GHSA-mw96-cpmx-2vgc

Current state

pnpm-lock.yaml resolves rollup@4.57.1
The version is pulled in via vite@7.3.1 and @mdx-js/rollup
The advisory is fixed in rollup@4.59.0

Impact

This appears to be a build-time/tooling exposure rather than a vinext runtime server issue, but the repository should still stop resolving the vulnerable Rollup version.

Proposed fix

Add a pnpm override for rollup and refresh the lockfile so the workspace resolves 4.59.0 or newer.

Validation

vite@7.3.1 accepts newer Rollup versions (^4.43.0), so 4.59.0 is semver-compatible.

Originally created by @Divkix on GitHub (Mar 11, 2026). Original GitHub issue: https://github.com/cloudflare/vinext/issues/475 ## Summary The repo currently resolves `rollup@4.57.1` in the workspace lockfile, which is affected by `CVE-2026-27606` / `GHSA-mw96-cpmx-2vgc`. GitHub Advisory: https://github.com/advisories/GHSA-mw96-cpmx-2vgc OSV: https://osv.dev/vulnerability/GHSA-mw96-cpmx-2vgc ## Current state - `pnpm-lock.yaml` resolves `rollup@4.57.1` - The version is pulled in via `vite@7.3.1` and `@mdx-js/rollup` - The advisory is fixed in `rollup@4.59.0` ## Impact This appears to be a build-time/tooling exposure rather than a vinext runtime server issue, but the repository should still stop resolving the vulnerable Rollup version. ## Proposed fix Add a pnpm override for `rollup` and refresh the lockfile so the workspace resolves `4.59.0` or newer. ## Validation `vite@7.3.1` accepts newer Rollup versions (`^4.43.0`), so `4.59.0` is semver-compatible.