Repository navigation
[VANTA] [VULNERABILITY] <MEDIUM> CVE-2025-62718, CVE-2026-40175, CVE-2026-67312 and others, fix before 2026-11-02 #37
Description
Important
CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.
DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.
FIXED npm-axios >= 1.0.0, < 1.15.0 CVE-2026-40175 MEDIUM
npm-axios >= 1.0.0, < 1.15.0 CODE_REPOSITORY/examples CVE-2026-40175 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-fvcv-3m26-pcqx
- axios/axios@3631854
- https://github.com/axios/axios/releases/tag/v1.15.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-40175
- fix: unrestricted cloud metadata exfiltration via header injection chain axios/axios#10660
- fix: unrestricted cloud metadata exfiltration via header injection chain axios/axios#10660 (comment)
- fix: backport the fixes from the v1 branch axios/axios#10688
- axios/axios@03cdfc9
- https://github.com/axios/axios/releases/tag/v0.31.0
- https://cert-portal.siemens.com/productcert/html/ssa-876049.html
- GHSA-fvcv-3m26-pcqx
FIXED npm-axios >= 1.0.0, < 1.15.0 CVE-2025-62718 MEDIUM
npm-axios >= 1.0.0, < 1.15.0 CODE_REPOSITORY/examples CVE-2025-62718 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-3p68-rc4w-qgx5
- https://nvd.nist.gov/vuln/detail/CVE-2025-62718
- fix: no_proxy hostname normalization bypass leads to ssrf axios/axios#10661
- axios/axios@fb3befb
- https://datatracker.ietf.org/doc/html/rfc1034#section-3.1
- https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
- https://github.com/axios/axios/releases/tag/v1.15.0
- fix: backport the fixes from the v1 branch axios/axios#10688
- axios/axios@03cdfc9
- https://github.com/axios/axios/releases/tag/v0.31.0
- GHSA-3p68-rc4w-qgx5
FIXED npm-axios >= 1.0.0, < 1.18.0 CVE-2026-67312 MEDIUM
npm-axios >= 1.0.0, < 1.18.0 CODE_REPOSITORY/examples CVE-2026-67312 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-pmv8-rq9r-6j72
- fix: malformed http urls axios/axios#11000
- fix: improve request config handling axios/axios#11001
- axios/axios@1417285
- axios/axios@32fc489
- https://github.com/axios/axios/releases/tag/v0.33.0
- https://github.com/axios/axios/releases/tag/v1.18.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-67312
- https://nvd.nist.gov/vuln/detail/CVE-2026-68941
- https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson
- GHSA-pmv8-rq9r-6j72
FIXED npm-axios >= 1.0.0, < 1.18.0 CVE-2026-67313 MEDIUM
npm-axios >= 1.0.0, < 1.18.0 CODE_REPOSITORY/examples CVE-2026-67313 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-42h9-826w-cgv3
- fix: malformed http urls axios/axios#11000
- fix: improve request config handling axios/axios#11001
- axios/axios@1417285
- axios/axios@32fc489
- https://github.com/axios/axios/releases/tag/v0.33.0
- https://github.com/axios/axios/releases/tag/v1.18.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-67313
- https://nvd.nist.gov/vuln/detail/CVE-2026-68942
- https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson
- GHSA-42h9-826w-cgv3
FIXED npm-axios >= 1.0.0, < 1.18.0 CVE-2026-67316 MEDIUM
npm-axios >= 1.0.0, < 1.18.0 CODE_REPOSITORY/examples CVE-2026-67316 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-mmx7-hfxf-jppx
- fix: malformed http urls axios/axios#11000
- fix: improve request config handling axios/axios#11001
- axios/axios@1417285
- axios/axios@32fc489
- https://github.com/axios/axios/releases/tag/v0.33.0
- https://github.com/axios/axios/releases/tag/v1.18.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-67316
- https://nvd.nist.gov/vuln/detail/CVE-2026-68944
- https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods
- GHSA-mmx7-hfxf-jppx
FIXED npm-axios >= 1.0.0, < 1.18.0 CVE-2026-67319 MEDIUM
npm-axios >= 1.0.0, < 1.18.0 CODE_REPOSITORY/examples CVE-2026-67319 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-7q8q-rj6j-mhjq
- fix: malformed http urls axios/axios#11000
- fix: improve request config handling axios/axios#11001
- axios/axios@1417285
- axios/axios@32fc489
- https://github.com/axios/axios/releases/tag/v0.33.0
- https://github.com/axios/axios/releases/tag/v1.18.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-67319
- https://nvd.nist.gov/vuln/detail/CVE-2026-69123
- https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects
- GHSA-7q8q-rj6j-mhjq
FIXED npm-react-router >= 6.4.0, < 7.18.0 CVE-2026-53666 MEDIUM
npm-react-router >= 6.4.0, < 7.18.0 CODE_REPOSITORY/examples CVE-2026-53666 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
FIXED npm-next >= 10.0.0, < 14.2.7 CVE-2024-47831 MEDIUM
npm-next >= 10.0.0, < 14.2.7 CODE_REPOSITORY/examples CVE-2024-47831 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-next >= 10.0.0, < 15.5.10 CVE-2025-59471 MEDIUM
npm-next >= 10.0.0, < 15.5.10 CODE_REPOSITORY/examples CVE-2025-59471 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-h3 <= 1.15.8 GHSA-72gr-qfp7-vwhw MEDIUM
npm-h3 <= 1.15.8 CODE_REPOSITORY/examples GHSA-72gr-qfp7-vwhw MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
FIXED npm-next >= 10.0.0, < 15.5.16 CVE-2026-44577 MEDIUM
npm-next >= 10.0.0, < 15.5.16 CODE_REPOSITORY/examples CVE-2026-44577 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-@hono/node-server >= 2.0.0, < 2.0.5 GHSA-frvp-7c67-39w9 MEDIUM
npm-@hono/node-server >= 2.0.0, < 2.0.5 CODE_REPOSITORY/examples GHSA-frvp-7c67-39w9 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-next >= 14.2.0, < 15.5.16 CVE-2026-44576 MEDIUM
npm-next >= 14.2.0, < 15.5.16 CODE_REPOSITORY/examples CVE-2026-44576 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-postcss < 8.4.31 CVE-2023-44270 MEDIUM
npm-postcss < 8.4.31 CODE_REPOSITORY/examples CVE-2023-44270 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- https://nvd.nist.gov/vuln/detail/CVE-2023-44270
- postcss/postcss@58cc860
- https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25
- https://github.com/postcss/postcss/releases/tag/8.4.31
- GHSA-7fh5-64p2-3v2j contains no security impact github/advisory-database#2820
- https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
- GHSA-7fh5-64p2-3v2j
FIXED npm-micromatch < 4.0.8 CVE-2024-4067 MEDIUM
npm-micromatch < 4.0.8 CODE_REPOSITORY/examples CVE-2024-4067 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- https://nvd.nist.gov/vuln/detail/CVE-2024-4067
- [BUG] Vulnerabilities Found in Micromatch and Braces micromatch/micromatch#243
- Update index.js micromatch/micromatch#247
- https://devhub.checkmarx.com/cve-details/CVE-2024-4067
- https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448
- micromatch/micromatch@500d5d6
- Backport CVE-2024-4067 fix from 4.0.6 over 4.0.7 micromatch/micromatch#266
- micromatch/micromatch@03aa805
- https://advisory.checkmarx.net/advisory/CVE-2024-4067
- https://github.com/micromatch/micromatch/releases/tag/4.0.8
- GHSA-952p-6rrq-rcjv
FIXED npm-next >= 13.0.0, < 13.5.8 CVE-2024-56332 MEDIUM
npm-next >= 13.0.0, < 13.5.8 CODE_REPOSITORY/examples CVE-2024-56332 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-next >= 14.0.0, < 14.2.21 CVE-2024-56332 MEDIUM
npm-next >= 14.0.0, < 14.2.21 CODE_REPOSITORY/examples CVE-2024-56332 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-h3 < 1.15.9 GHSA-4hxc-9384-m385 MEDIUM
npm-h3 < 1.15.9 CODE_REPOSITORY/examples GHSA-4hxc-9384-m385 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
FIXED npm-qs >= 6.11.1, <= 6.15.1 CVE-2026-8723 MEDIUM
npm-qs >= 6.11.1, <= 6.15.1 CODE_REPOSITORY/examples CVE-2026-8723 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-joi < 17.13.4 CVE-2026-48038 MEDIUM
npm-joi < 17.13.4 CODE_REPOSITORY/examples CVE-2026-48038 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-morgan >= 1.2.0, <= 1.10.1 CVE-2026-5078 MEDIUM
npm-morgan >= 1.2.0, <= 1.10.1 CODE_REPOSITORY/examples CVE-2026-5078 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-@hono/node-server >= 2.0.0, <= 2.0.9 CVE-2026-73565 MEDIUM
npm-@hono/node-server >= 2.0.0, <= 2.0.9 CODE_REPOSITORY/examples CVE-2026-73565 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-hono < 4.12.34 CVE-2026-69207 MEDIUM
npm-hono < 4.12.34 CODE_REPOSITORY/examples CVE-2026-69207 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-hono >= 4.12.0, < 4.12.34 CVE-2026-71848 MEDIUM
npm-hono >= 4.12.0, < 4.12.34 CODE_REPOSITORY/examples CVE-2026-71848 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-axios < 0.31.0 CVE-2026-40175 MEDIUM
npm-axios < 0.31.0 CODE_REPOSITORY/examples CVE-2026-40175 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-fvcv-3m26-pcqx
- axios/axios@3631854
- https://github.com/axios/axios/releases/tag/v1.15.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-40175
- fix: unrestricted cloud metadata exfiltration via header injection chain axios/axios#10660
- fix: unrestricted cloud metadata exfiltration via header injection chain axios/axios#10660 (comment)
- fix: backport the fixes from the v1 branch axios/axios#10688
- axios/axios@03cdfc9
- https://github.com/axios/axios/releases/tag/v0.31.0
- https://cert-portal.siemens.com/productcert/html/ssa-876049.html
- GHSA-fvcv-3m26-pcqx
FIXED npm-axios < 0.31.0 CVE-2025-62718 MEDIUM
npm-axios < 0.31.0 CODE_REPOSITORY/examples CVE-2025-62718 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-3p68-rc4w-qgx5
- https://nvd.nist.gov/vuln/detail/CVE-2025-62718
- fix: no_proxy hostname normalization bypass leads to ssrf axios/axios#10661
- axios/axios@fb3befb
- https://datatracker.ietf.org/doc/html/rfc1034#section-3.1
- https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
- https://github.com/axios/axios/releases/tag/v1.15.0
- fix: backport the fixes from the v1 branch axios/axios#10688
- axios/axios@03cdfc9
- https://github.com/axios/axios/releases/tag/v0.31.0
- GHSA-3p68-rc4w-qgx5
FIXED npm-hono >= 4.3.3, < 4.12.27 CVE-2026-59897 MEDIUM
npm-hono >= 4.3.3, < 4.12.27 CODE_REPOSITORY/examples CVE-2026-59897 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-hono >= 3.8.0, < 4.12.34 CVE-2026-71850 MEDIUM
npm-hono >= 3.8.0, < 4.12.34 CODE_REPOSITORY/examples CVE-2026-71850 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-next >= 13.4.0, < 15.5.16 CVE-2026-44581 MEDIUM
npm-next >= 13.4.0, < 15.5.16 CODE_REPOSITORY/examples CVE-2026-44581 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-nanoid < 3.3.8 CVE-2024-55565 MEDIUM
npm-nanoid < 3.3.8 CODE_REPOSITORY/examples CVE-2024-55565 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- https://nvd.nist.gov/vuln/detail/CVE-2024-55565
- Fix pool pollution, infinite loop ai/nanoid#510
- ai/nanoid@3.3.7...3.3.8
- https://github.com/ai/nanoid/releases/tag/5.0.9
- https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
- https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html
- GHSA-mwcw-c2x4-8c55
FIXED npm-yaml >= 2.0.0, < 2.8.3 CVE-2026-33532 MEDIUM
npm-yaml >= 2.0.0, < 2.8.3 CODE_REPOSITORY/examples CVE-2026-33532 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-qs < 6.14.1 CVE-2025-15284 MEDIUM
npm-qs < 6.14.1 CODE_REPOSITORY/examples CVE-2025-15284 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-next >= 9.5.0, < 15.5.13 CVE-2026-29057 MEDIUM
npm-next >= 9.5.0, < 15.5.13 CODE_REPOSITORY/examples CVE-2026-29057 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-next >= 10.0.0, < 15.5.14 CVE-2026-27980 MEDIUM
npm-next >= 10.0.0, < 15.5.14 CODE_REPOSITORY/examples CVE-2026-27980 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-follow-redirects <= 1.15.11 GHSA-r4q5-vmmm-2653 MEDIUM
npm-follow-redirects <= 1.15.11 CODE_REPOSITORY/examples GHSA-r4q5-vmmm-2653 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-axios >= 1.7.0, < 1.18.0 CVE-2026-67317 MEDIUM
npm-axios >= 1.7.0, < 1.18.0 CODE_REPOSITORY/examples CVE-2026-67317 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-jqh4-m9w3-8hp9
- fix: malformed http urls axios/axios#11000
- axios/axios@32fc489
- https://github.com/axios/axios/releases/tag/v1.18.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-67317
- https://nvd.nist.gov/vuln/detail/CVE-2026-68947
- https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream
- GHSA-jqh4-m9w3-8hp9
FIXED npm-axios < 0.33.0 CVE-2026-67316 MEDIUM
npm-axios < 0.33.0 CODE_REPOSITORY/examples CVE-2026-67316 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-mmx7-hfxf-jppx
- fix: malformed http urls axios/axios#11000
- fix: improve request config handling axios/axios#11001
- axios/axios@1417285
- axios/axios@32fc489
- https://github.com/axios/axios/releases/tag/v0.33.0
- https://github.com/axios/axios/releases/tag/v1.18.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-67316
- https://nvd.nist.gov/vuln/detail/CVE-2026-68944
- https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods
- GHSA-mmx7-hfxf-jppx
FIXED npm-axios >= 0.8.0, < 0.33.0 CVE-2026-67319 MEDIUM
npm-axios >= 0.8.0, < 0.33.0 CODE_REPOSITORY/examples CVE-2026-67319 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-7q8q-rj6j-mhjq
- fix: malformed http urls axios/axios#11000
- fix: improve request config handling axios/axios#11001
- axios/axios@1417285
- axios/axios@32fc489
- https://github.com/axios/axios/releases/tag/v0.33.0
- https://github.com/axios/axios/releases/tag/v1.18.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-67319
- https://nvd.nist.gov/vuln/detail/CVE-2026-69123
- https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects
- GHSA-7q8q-rj6j-mhjq
FIXED npm-next >= 15.5.0, < 15.5.21 CVE-2026-64644 MEDIUM
npm-next >= 15.5.0, < 15.5.21 CODE_REPOSITORY/examples CVE-2026-64644 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-react-router >= 6.0.0, < 7.18.0 CVE-2026-53669 MEDIUM
npm-react-router >= 6.0.0, < 7.18.0 CODE_REPOSITORY/examples CVE-2026-53669 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-wrjc-x8rr-h8h6
- Consolidate url normalization logic remix-run/react-router#15176
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
- https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
- http://github.com/remix-run/react-router/pull/15176
- GHSA-wrjc-x8rr-h8h6
FIXED npm-postcss <= 8.5.22 CVE-2026-69153 MEDIUM
npm-postcss <= 8.5.22 CODE_REPOSITORY/examples CVE-2026-69153 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
FIXED npm-decode-uri-component <= 0.4.2 CVE-2026-45822 MEDIUM
npm-decode-uri-component <= 0.4.2 CODE_REPOSITORY/examples CVE-2026-45822 MEDIUM remediate by: 2026-11-02T14:05:20.177Z
Related URLs
- GHSA-vcc3-ghjq-m6fr
- https://nvd.nist.gov/vuln/detail/CVE-2026-45822
- SamVerschueren/decode-uri-component@fa479da
- https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js
- https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.0
- https://www.npmjs.com/package/decode-uri-component
- GHSA-vcc3-ghjq-m6fr
FIXED npm-express < 4.20.0 CVE-2024-43796 LOW
npm-express < 4.20.0 CODE_REPOSITORY/examples CVE-2024-43796 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-serve-static < 1.16.0 CVE-2024-43800 LOW
npm-serve-static < 1.16.0 CODE_REPOSITORY/examples CVE-2024-43800 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-send < 0.19.0 CVE-2024-43799 LOW
npm-send < 0.19.0 CODE_REPOSITORY/examples CVE-2024-43799 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-postcss-selector-parser >= 6.1.0, < 6.1.3 CVE-2026-9358 LOW
npm-postcss-selector-parser >= 6.1.0, < 6.1.3 CODE_REPOSITORY/examples CVE-2026-9358 LOW remediate by: 2026-12-02T14:05:20.740Z
Related URLs
- https://nvd.nist.gov/vuln/detail/CVE-2026-9358
- https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9
- https://vuldb.com/submit/813080
- https://vuldb.com/vuln/365321
- https://vuldb.com/vuln/365321/cti
- postcss/postcss-selector-parser@5bc698c
- postcss/postcss-selector-parser@e37c5b0
- https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.3
- https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.3
- https://vuldb.com/cve/CVE-2026-9358
- GHSA-w9m9-85wc-3x92
FIXED npm-next >= 0.9.9, < 14.2.24 CVE-2025-32421 LOW
npm-next >= 0.9.9, < 14.2.24 CODE_REPOSITORY/examples CVE-2025-32421 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-@auth0/nextjs-auth0 >= 4.9.0, < 4.13.0 CVE-2025-67716 LOW
npm-@auth0/nextjs-auth0 >= 4.9.0, < 4.13.0 CODE_REPOSITORY/examples CVE-2025-67716 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-qs >= 6.7.0, <= 6.14.1 CVE-2026-2391 LOW
npm-qs >= 6.7.0, <= 6.14.1 CODE_REPOSITORY/examples CVE-2026-2391 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-next >= 13.4.6, < 15.5.16 CVE-2026-44582 LOW
npm-next >= 13.4.6, < 15.5.16 CODE_REPOSITORY/examples CVE-2026-44582 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-body-parser < 1.20.6 CVE-2026-12590 LOW
npm-body-parser < 1.20.6 CODE_REPOSITORY/examples CVE-2026-12590 LOW remediate by: 2026-12-02T14:05:20.740Z
Related URLs
- GHSA-v422-hmwv-36x6
- https://nvd.nist.gov/vuln/detail/CVE-2026-12590
- fix: improve limit option validation expressjs/body-parser#698
- fix: improve limit option validation expressjs/body-parser#741
- expressjs/body-parser@2322e11
- expressjs/body-parser@3492672
- https://cna.openjsf.org/security-advisories.html
- https://github.com/expressjs/body-parser/releases/tag/1.20.6
- https://github.com/expressjs/body-parser/releases/tag/v2.3.0
- GHSA-v422-hmwv-36x6
FIXED npm-hono >= 4.7.0, < 4.12.34 CVE-2026-71849 LOW
npm-hono >= 4.7.0, < 4.12.34 CODE_REPOSITORY/examples CVE-2026-71849 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-@babel/core <= 7.29.0 CVE-2026-49356 LOW
npm-@babel/core <= 7.29.0 CODE_REPOSITORY/examples CVE-2026-49356 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-brace-expansion >= 2.0.0, <= 2.0.1 CVE-2025-5889 LOW
npm-brace-expansion >= 2.0.0, <= 2.0.1 CODE_REPOSITORY/examples CVE-2025-5889 LOW remediate by: 2026-12-02T14:05:20.740Z
Related URLs
- https://nvd.nist.gov/vuln/detail/CVE-2025-5889
- juliangruber/brace-expansion@a5b98a4
- https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466
- https://vuldb.com/?ctiid.311660
- https://vuldb.com/?id.311660
- https://vuldb.com/?submit.585717
- juliangruber/brace-expansion@0b6a978
- juliangruber/brace-expansion@15f9b3c
- juliangruber/brace-expansion@36603d5
- juliangruber/brace-expansion@c3c73c8
- GHSA-v6h2-p8h4-qcjw
FIXED npm-brace-expansion >= 1.0.0, <= 1.1.11 CVE-2025-5889 LOW
npm-brace-expansion >= 1.0.0, <= 1.1.11 CODE_REPOSITORY/examples CVE-2025-5889 LOW remediate by: 2026-12-02T14:05:20.740Z
Related URLs
- https://nvd.nist.gov/vuln/detail/CVE-2025-5889
- juliangruber/brace-expansion@a5b98a4
- https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466
- https://vuldb.com/?ctiid.311660
- https://vuldb.com/?id.311660
- https://vuldb.com/?submit.585717
- juliangruber/brace-expansion@0b6a978
- juliangruber/brace-expansion@15f9b3c
- juliangruber/brace-expansion@36603d5
- juliangruber/brace-expansion@c3c73c8
- GHSA-v6h2-p8h4-qcjw
FIXED npm-esbuild >= 0.27.3, < 0.28.1 GHSA-g7r4-m6w7-qqqr LOW
npm-esbuild >= 0.27.3, < 0.28.1 CODE_REPOSITORY/examples GHSA-g7r4-m6w7-qqqr LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-next >= 0.9.9, < 13.4.20-canary.13 CVE-2023-46298 LOW
npm-next >= 0.9.9, < 13.4.20-canary.13 CODE_REPOSITORY/examples CVE-2023-46298 LOW remediate by: 2026-12-02T14:05:20.740Z
Related URLs
- https://nvd.nist.gov/vuln/detail/CVE-2023-46298
- Missing cache control directive for server side props response when using middleware and prefetch vercel/next.js#45301
- Add cache control header for prefetch empty responses vercel/next.js#54732
- vercel/next.js@v13.4.20-canary.12...v13.4.20-canary.13
- vercel/next.js@20d0595
- GHSA-c59h-r6p8-q9wc
FIXED npm-es5-ext >= 0.10.0, < 0.10.63 CVE-2024-27088 LOW
npm-es5-ext >= 0.10.0, < 0.10.63 CODE_REPOSITORY/examples CVE-2024-27088 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-cookie < 0.7.0 CVE-2024-47764 LOW
npm-cookie < 0.7.0 CODE_REPOSITORY/examples CVE-2024-47764 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-next >= 13.0, < 14.2.30 CVE-2025-48068 LOW
npm-next >= 13.0, < 14.2.30 CODE_REPOSITORY/examples CVE-2025-48068 LOW remediate by: 2026-12-02T14:05:20.740Z
FIXED npm-@humanfs/node < 0.16.8 GHSA-p498-v437-472g MEDIUM
npm-@humanfs/node < 0.16.8 CODE_REPOSITORY/examples GHSA-p498-v437-472g MEDIUM remediate by: 2026-11-02T14:05:20.177Z
REPO TAG SKIPPED (no releases)
Activity
[-][VANTA] [VULNERABILITY] <MEDIUM> CVE-2023-44270, CVE-2023-46298, CVE-2024-27088 and others, fix before 2026-11-02[/-][+][VANTA] [VULNERABILITY] <MEDIUM> CVE-2025-62718, CVE-2026-40175, CVE-2026-67312 and others, fix before 2026-11-02[/+]commercelayer-ci commentedon Sep 10, 2026
CODE_REPOSITORY/examples
commercelayer-ci commentedon Sep 15, 2026
No vulnerability is detected anymore.