CVE-2023-6460: Logging of the firestore key within nodejs-firestore

December 4, 2023 (updated May 8, 2026)

A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue

References

bughunters.google.com/reports/vrp/KNvgo1Wij
github.com/advisories/GHSA-4g6q-77j7-vvjc
github.com/googleapis/nodejs-firestore/pull/1742
github.com/googleapis/nodejs-firestore/releases/tag/v6.1.0
nvd.nist.gov/vuln/detail/CVE-2023-6460

Code Behaviors & Features

Detect and mitigate CVE-2023-6460 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →