AIKIDO-2026-831388
@shopify/shopify-app-remix is vulnerable to Improper Verification of Cryptographic Signature
59
Medium Risk
This Affects:
@shopify/shopify-app-remixTL;DR
The app proxy authentication flow in @shopify/shopify-app-remix verifies a Shopify-signed request by validating an HMAC over the forwarded query parameters. Before the fix, the validation flattened the query string in a way that mishandled repeated parameters, so duplicated security parameters such as signature, shop, or timestamp could desynchronize the value used for signature verification from the value the application later reads. This gap lets a tampered app proxy request pass HMAC validation while carrying externally influenced parameter values, undermining the request's authenticity. The fix consumes structured URL search parameters and rejects repeated security parameters while still preserving repeated application query parameters.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your app authenticates Shopify app proxy requests.
Background info
@shopify/shopify-app-remix is vulnerable to Improper Verification of Cryptographic Signature in versions 1.2.0 - 4.2.1.
How to fix this
Upgrade the @shopify/shopify-app-remix library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant