Zwavejs2mqtt uses log4j - vulnerable to log4shell

Hi,

I noticed that zwavejs2mqtt uses log4j.
How to disable it OR upload to avoid being vulnerable to log4shell?

I just checked the github repo, searching for log4j doesn’t show any matches. Where are you seeing these references?

No, we do not. Zjs2mqtt is written in JavaScript/TypeScript, not Java. We use the Winston logger.

6 Likes