From 3b043ee8bfebe29b9f9071e658f209087042f5f0 Mon Sep 17 00:00:00 2001
From: Harshit Jain <48647625+Harshit28j@users.noreply.github.com>
Date: Sun, 8 Feb 2026 11:53:01 +0530
Subject: [PATCH] fix critical CVE vulnerabliltes (#20683)

---
 .dockerignore                                 |  2 +-
 Dockerfile                                    | 31 ++++++++++++++++++-
 ci_cd/security_scans.sh                       |  5 +--
 docker/Dockerfile.custom_ui                   | 13 +++++++-
 docker/Dockerfile.database                    | 29 ++++++++++++++---
 docker/Dockerfile.dev                         | 27 +++++++++++++++-
 docker/Dockerfile.non_root                    | 29 ++++++++++++++---
 docs/my-website/package.json                  |  2 ++
 litellm-js/spend-logs/package.json            |  4 ++-
 package.json                                  |  4 ++-
 requirements.txt                              |  5 +++
 tests/proxy_admin_ui_tests/package.json       |  4 ++-
 .../ui_unit_tests/package.json                |  4 ++-
 ui/litellm-dashboard/package.json             |  2 ++
 14 files changed, 141 insertions(+), 20 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 76e31546c2..a487d2a859 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -48,7 +48,7 @@ dist/
 build/
 *.egg-info/
 .DS_Store
-node_modules/
+**/node_modules
 *.log
 .env
 .env.local
diff --git a/Dockerfile b/Dockerfile
index 717ec2bcb7..5e93a0c627 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -49,7 +49,22 @@ USER root
 
 # Install runtime dependencies (libsndfile needed for audio processing on ARM64)
 RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
-    npm install -g npm@latest tar@latest
+    npm install -g npm@latest tar@7.5.7 glob@11.1.0 @isaacs/brace-expansion@5.0.1 && \
+    # SECURITY FIX: npm bundles tar, glob, and brace-expansion at multiple nested
+    # levels inside its dependency tree. `npm install -g <pkg>` only creates a
+    # SEPARATE global package, it does NOT replace npm's internal copies.
+    # We must find and replace EVERY copy inside npm's directory.
+    GLOBAL="$(npm root -g)" && \
+    find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done && \
+    npm cache clean --force
 
 WORKDIR /app
 # Copy the current directory contents into the container at /app
@@ -71,6 +86,20 @@ RUN NODEJS_WHEEL_NODE=$(find /usr/lib -path "*/nodejs_wheel/bin/node" 2>/dev/nul
 RUN find /usr/lib -type f -path "*/tornado/test/*" -delete && \
     find /usr/lib -type d -path "*/tornado/test" -delete
 
+# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
+# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
+# Patch every copy of tar, glob, and brace-expansion inside that tree.
+RUN GLOBAL="$(npm root -g)" && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/tar" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/glob" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/@isaacs/brace-expansion" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done
+
 # Install semantic_router and aurelio-sdk using script
 # Convert Windows line endings to Unix and make executable
 RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh
diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh
index 770610c2a3..3ffa13c444 100755
--- a/ci_cd/security_scans.sh
+++ b/ci_cd/security_scans.sh
@@ -155,10 +155,7 @@ run_grype_scans() {
         "CVE-2025-12781" # No fix available yet
         "CVE-2025-11468" # No fix available yet
         "CVE-2026-1299" # Python 3.13 email module header injection - not applicable, LiteLLM doesn't use BytesGenerator for email serialization
-        "GHSA-7h2j-956f-4vf2" # @isaacs/brace-expansion ReDoS - npm tooling dependency, not used in application runtime
-        "GHSA-hx9q-6w63-j58v" # orjson deep recursion - no fix available yet
-        "GHSA-8qq5-rm4j-mr97" # node-tar symlink poisoning - npm tooling dependency, tar CLI not exposed in application code
-        "GHSA-29xp-372q-xqph" # node-tar race condition - npm tooling dependency, tar CLI not exposed in application code
+        "CVE-2026-0775" # npm cli incorrect permission assignment - no fix available yet, npm is only used at build/prisma-generate time
     )
 
     # Build JSON array of allowlisted CVE IDs for jq
diff --git a/docker/Dockerfile.custom_ui b/docker/Dockerfile.custom_ui
index 57926bcd17..177d7b7b12 100644
--- a/docker/Dockerfile.custom_ui
+++ b/docker/Dockerfile.custom_ui
@@ -6,7 +6,18 @@ WORKDIR /app
 
 # Install Node.js and npm (adjust version as needed)
 RUN apt-get update && apt-get install -y nodejs npm && \
-    npm install -g npm@latest tar@latest
+    npm install -g npm@latest tar@7.5.7 glob@11.1.0 @isaacs/brace-expansion@5.0.1 && \
+    GLOBAL="$(npm root -g)" && \
+    find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done && \
+    npm cache clean --force
 
 # Copy the UI source into the container
 COPY ./ui/litellm-dashboard /app/ui/litellm-dashboard
diff --git a/docker/Dockerfile.database b/docker/Dockerfile.database
index ecbe76446f..a6fcd98ab6 100644
--- a/docker/Dockerfile.database
+++ b/docker/Dockerfile.database
@@ -50,7 +50,18 @@ USER root
 
 # Install runtime dependencies
 RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
-    npm install -g npm@latest tar@latest
+    npm install -g npm@latest tar@7.5.7 glob@11.1.0 @isaacs/brace-expansion@5.0.1 && \
+    GLOBAL="$(npm root -g)" && \
+    find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done && \
+    npm cache clean --force
 
 WORKDIR /app
 # Copy the current directory contents into the container at /app
@@ -64,9 +75,19 @@ COPY --from=builder /wheels/ /wheels/
 # Install the built wheel using pip; again using a wildcard if it's the only file
 RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl && rm -rf /wheels
 
-# Replace the nodejs-wheel-binaries bundled node with the system node (fixes CVE-2025-55130)
-RUN NODEJS_WHEEL_NODE=$(find /usr/lib -path "*/nodejs_wheel/bin/node" 2>/dev/null) && \
-    if [ -n "$NODEJS_WHEEL_NODE" ]; then cp /usr/bin/node "$NODEJS_WHEEL_NODE"; fi
+# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
+# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
+# Patch every copy of tar, glob, and brace-expansion inside that tree.
+RUN GLOBAL="$(npm root -g)" && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/tar" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/glob" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/@isaacs/brace-expansion" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done
 
 # Install semantic_router and aurelio-sdk using script
 # Convert Windows line endings to Unix and make executable
diff --git a/docker/Dockerfile.dev b/docker/Dockerfile.dev
index ae557d4647..bc1d22d5e0 100644
--- a/docker/Dockerfile.dev
+++ b/docker/Dockerfile.dev
@@ -62,7 +62,18 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     nodejs \
     npm \
     && rm -rf /var/lib/apt/lists/* \
-    && npm install -g npm@latest tar@latest
+    && npm install -g npm@latest tar@7.5.7 glob@11.1.0 @isaacs/brace-expansion@5.0.1 \
+    && GLOBAL="$(npm root -g)" \
+    && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
+          rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+       done \
+    && find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
+          rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+       done \
+    && find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
+          rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+       done \
+    && npm cache clean --force
 
 WORKDIR /app
 
@@ -80,6 +91,20 @@ RUN pip install --no-cache-dir *.whl /wheels/* --no-index --find-links=/wheels/
     rm -f *.whl && \
     rm -rf /wheels
 
+# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
+# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
+# Patch every copy of tar, glob, and brace-expansion inside that tree.
+RUN GLOBAL="$(npm root -g)" && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/tar" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/glob" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/@isaacs/brace-expansion" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done
+
 # Generate prisma client and set permissions
 # Convert Windows line endings to Unix for entrypoint scripts
 RUN prisma generate && \
diff --git a/docker/Dockerfile.non_root b/docker/Dockerfile.non_root
index 4b09755ed7..64126bb029 100644
--- a/docker/Dockerfile.non_root
+++ b/docker/Dockerfile.non_root
@@ -104,7 +104,18 @@ RUN for i in 1 2 3; do \
   && for i in 1 2 3; do \
     apk add --no-cache python3 py3-pip bash openssl tzdata nodejs npm supervisor && break || sleep 5; \
     done \
-  && npm install -g npm@latest tar@latest
+  && npm install -g npm@latest tar@7.5.7 glob@11.1.0 @isaacs/brace-expansion@5.0.1 \
+  && GLOBAL="$(npm root -g)" \
+  && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+     done \
+  && find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+     done \
+  && find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+     done \
+  && npm cache clean --force
 
 # Copy artifacts from builder
 COPY --from=builder /app/requirements.txt /app/requirements.txt
@@ -146,9 +157,19 @@ RUN pip install --no-index --find-links=/wheels/ -r requirements.txt && \
       fi; \
     fi
 
-# Replace the nodejs-wheel-binaries bundled node with the system node (fixes CVE-2025-55130)
-RUN NODEJS_WHEEL_NODE=$(find /usr/lib -path "*/nodejs_wheel/bin/node" 2>/dev/null) && \
-    if [ -n "$NODEJS_WHEEL_NODE" ]; then cp /usr/bin/node "$NODEJS_WHEEL_NODE"; fi
+# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
+# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
+# Patch every copy of tar, glob, and brace-expansion inside that tree.
+RUN GLOBAL="$(npm root -g)" && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/tar" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/glob" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find /usr/lib -path "*/nodejs_wheel/*/node_modules/@isaacs/brace-expansion" -type d | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done
 
 # Permissions, cleanup, and Prisma prep
 # Convert Windows line endings to Unix for entrypoint scripts
diff --git a/docs/my-website/package.json b/docs/my-website/package.json
index 4c3db68056..4af7a168f8 100644
--- a/docs/my-website/package.json
+++ b/docs/my-website/package.json
@@ -61,6 +61,8 @@
     "mermaid": ">=11.10.0",
     "gray-matter": "4.0.3",
     "glob": ">=11.1.0",
+    "tar": ">=7.5.7",
+    "@isaacs/brace-expansion": ">=5.0.1",
     "node-forge": ">=1.3.2",
     "mdast-util-to-hast": ">=13.2.1",
     "lodash-es": ">=4.17.23"
diff --git a/litellm-js/spend-logs/package.json b/litellm-js/spend-logs/package.json
index 9c1c2d4f6d..6729256714 100644
--- a/litellm-js/spend-logs/package.json
+++ b/litellm-js/spend-logs/package.json
@@ -11,6 +11,8 @@
     "tsx": "^4.7.1"
   },
   "overrides": {
-    "glob": ">=11.1.0"
+    "glob": ">=11.1.0",
+    "tar": ">=7.5.7",
+    "@isaacs/brace-expansion": ">=5.0.1"
   }
 }
diff --git a/package.json b/package.json
index 7f90fd0aeb..ab9e15f46a 100644
--- a/package.json
+++ b/package.json
@@ -11,6 +11,8 @@
     "jest": "^29.7.0"
   },
   "overrides": {
-    "glob": ">=11.1.0"
+    "glob": ">=11.1.0",
+    "tar": ">=7.5.7",
+    "@isaacs/brace-expansion": ">=5.0.1"
   }
 }
diff --git a/requirements.txt b/requirements.txt
index 1f21cc62bc..f680de120c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,9 @@
 # LITELLM PROXY DEPENDENCIES #
+# Security: explicit pins for transitive deps (CVE fixes)
+urllib3>=2.6.0  # CVE-2025-66471, CVE-2025-66418, CVE-2026-21441
+tornado>=6.5.3  # CVE-2025-67725, CVE-2025-67726, CVE-2025-67724
+filelock>=3.20.1  # CVE-2025-68146
+
 anyio==4.8.0 # openai + http req.
 httpx==0.28.1
 openai==2.9.0  # openai req.
diff --git a/tests/proxy_admin_ui_tests/package.json b/tests/proxy_admin_ui_tests/package.json
index cbd25be881..48de2c1dba 100644
--- a/tests/proxy_admin_ui_tests/package.json
+++ b/tests/proxy_admin_ui_tests/package.json
@@ -12,6 +12,8 @@
     "@types/node": "^22.5.5"
   },
   "overrides": {
-    "glob": ">=11.1.0"
+    "glob": ">=11.1.0",
+    "tar": ">=7.5.7",
+    "@isaacs/brace-expansion": ">=5.0.1"
   }
 }
diff --git a/tests/proxy_admin_ui_tests/ui_unit_tests/package.json b/tests/proxy_admin_ui_tests/ui_unit_tests/package.json
index 7d82ee2e1a..4c7d7addf0 100644
--- a/tests/proxy_admin_ui_tests/ui_unit_tests/package.json
+++ b/tests/proxy_admin_ui_tests/ui_unit_tests/package.json
@@ -24,6 +24,8 @@
         "react-dom": "^18.2.0"
     },
     "overrides": {
-        "glob": ">=11.1.0"
+        "glob": ">=11.1.0",
+        "tar": ">=7.5.7",
+        "@isaacs/brace-expansion": ">=5.0.1"
     }
 }
\ No newline at end of file
diff --git a/ui/litellm-dashboard/package.json b/ui/litellm-dashboard/package.json
index efb11fec38..76ac97f008 100644
--- a/ui/litellm-dashboard/package.json
+++ b/ui/litellm-dashboard/package.json
@@ -84,6 +84,8 @@
     "mermaid": ">=11.10.0",
     "js-yaml": ">=4.1.1",
     "glob": ">=11.1.0",
+    "tar": ">=7.5.7",
+    "@isaacs/brace-expansion": ">=5.0.1",
     "node-forge": ">=1.3.2",
     "lodash-es": ">=4.17.23",
     "lodash": ">=4.17.23"