CVE-2023-6460: Logging of the firestore key within nodejs-firestore
Summary
CVE-2023-6460: Logging of the firestore key within nodejs-firestore. Affects @google-cloud/firestore versions < 6.1.0. Fixed in 6.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is @google-cloud/firestore, an npm package that provides a Node.js client library for Firestore, a flexible, scalable NoSQL cloud database. It allows developers to interact with Firestore and perform various operations such as reading, writing, and querying data. This package is widely used in Node.js applications that leverage Firestore for data storage and retrieval.
Vulnerability Detail
A potential logging vulnerability exists within nodejs-firestore. Developers who were logging objects through this._settings would inadvertently log the firestore key as well, potentially exposing it to anyone with logs read access. This vulnerability could lead to unauthorized access to the Firestore database, compromising the confidentiality of sensitive data. The vulnerability has a CVSS score of 4.0, indicating a moderate severity level.
How To Fix
Latest published version: 9.4.0 as of 23 Oct 2026
npm install @google-cloud/firestore@9.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.1.0
This is the first release that contains the fix.
npm install @google-cloud/firestore@6.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the package.
Conclusion
In conclusion, the @google-cloud/firestore package has a vulnerability that could lead to the logging of the firestore key, potentially compromising the security of the Firestore database. To fix this vulnerability, it is crucial to upgrade to version 6.1.0 of the package. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for @google-cloud/firestore →
FAQ
The vulnerability could potentially expose the firestore key to unauthorized individuals with logs read access, compromising the security and confidentiality of the Firestore database.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using package-lock.json to analyze the software without requiring access to the code or installation.
Yes, upgrading to version 6.1.0 of the @google-cloud/firestore package fixes this vulnerability. It is recommended to update the package as soon as possible.
There are no known exploits for this vulnerability at the moment. However, it is crucial to fix the vulnerability to prevent potential unauthorized access to the Firestore database.
No, the recommended solution is to upgrade to the fixed version of the package. This ensures that the vulnerability is fully addressed and the firestore key is no longer logged.
