[VANTA] [VULNERABILITY] <HIGH> CVE-2026-46625, fix before 2026-10-03

Important

CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.

DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

FIXED npm-js-cookie <= 3.0.5 CVE-2026-46625 HIGH

npm-js-cookie <= 3.0.5 CODE_REPOSITORY/examples CVE-2026-46625 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/747

Related URLs

GHSA-qjx8-664m-686j

https://nvd.nist.gov/vuln/detail/CVE-2026-46625

js-cookie/js-cookie@eb3c40e

https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7

GHSA-qjx8-664m-686j

FIXED npm-axios >= 1.0.0, < 1.16.0 CVE-2026-44494 HIGH

npm-axios >= 1.0.0, < 1.16.0 CODE_REPOSITORY/examples CVE-2026-44494 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/833

Related URLs

GHSA-35jp-ww65-95wh

GHSA-fvcv-3m26-pcqx

https://nvd.nist.gov/vuln/detail/CVE-2026-44494

GHSA-35jp-ww65-95wh

FIXED npm-axios >= 1.0.0, < 1.16.0 CVE-2026-44486 HIGH

npm-axios >= 1.0.0, < 1.16.0 CODE_REPOSITORY/examples CVE-2026-44486 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/810

Related URLs

GHSA-j5f8-grm9-p9fc

fix: clear stale header on redirect when target is no-proxy axios/axios#10794

axios/axios@afca61a

https://github.com/axios/axios/releases/tag/v0.32.0

https://github.com/axios/axios/releases/tag/v1.16.0

https://nvd.nist.gov/vuln/detail/CVE-2026-44486

GHSA-j5f8-grm9-p9fc

FIXED npm-axios >= 1.0.0, < 1.16.0 CVE-2026-44496 HIGH

npm-axios >= 1.0.0, < 1.16.0 CODE_REPOSITORY/examples CVE-2026-44496 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/808

Related URLs

GHSA-hfxv-24rg-xrqf

https://github.com/axios/axios/releases/tag/v0.32.0

https://github.com/axios/axios/releases/tag/v1.16.0

GHSA-hfxv-24rg-xrqf

FIXED npm-axios >= 1.0.0, < 1.16.0 CVE-2026-44487 HIGH

npm-axios >= 1.0.0, < 1.16.0 CODE_REPOSITORY/examples CVE-2026-44487 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/812

Related URLs

GHSA-p92q-9vqr-4j8v

https://github.com/axios/axios/releases/tag/v0.32.0

https://github.com/axios/axios/releases/tag/v1.16.0

https://nvd.nist.gov/vuln/detail/CVE-2026-44487

GHSA-p92q-9vqr-4j8v

FIXED npm-axios >= 1.0.0, < 1.16.0 CVE-2026-44490 MEDIUM

npm-axios >= 1.0.0, < 1.16.0 CODE_REPOSITORY/examples CVE-2026-44490 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/788

Related URLs

GHSA-898c-q2cr-xwhg

https://nvd.nist.gov/vuln/detail/CVE-2018-16487

https://nvd.nist.gov/vuln/detail/CVE-2026-44490

GHSA-898c-q2cr-xwhg

FIXED npm-axios >= 1.0.0, < 1.12.0 CVE-2025-58754 HIGH

npm-axios >= 1.0.0, < 1.12.0 CODE_REPOSITORY/examples CVE-2025-58754 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/274

Related URLs

GHSA-4hjh-wcwx-xvwj

fix(node): enforce maxContentLength for data: URLs axios/axios#7011

axios/axios@945435f

https://github.com/axios/axios/releases/tag/v1.12.0

https://nvd.nist.gov/vuln/detail/CVE-2025-58754

Backport maxContentLength vulnerability fix to v0.x axios/axios#7034

axios/axios@a1b1d3f

https://github.com/axios/axios/releases/tag/v0.30.2

axios/axios@c30252f

GHSA-4hjh-wcwx-xvwj

FIXED npm-axios >= 1.0.0, <= 1.13.4 CVE-2026-25639 HIGH

npm-axios >= 1.0.0, <= 1.13.4 CODE_REPOSITORY/examples CVE-2026-25639 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/399

Related URLs

GHSA-43fc-jf86-j433

Fix Denial of Service via __proto__ Key in mergeConfig axios/axios#7369

axios/axios@28c7215

https://github.com/axios/axios/releases/tag/v1.13.5

https://nvd.nist.gov/vuln/detail/CVE-2026-25639

fix: backport DOS via __proto__ key in merge config fix to v0.x axios/axios#7388

axios/axios@d7ff140

https://github.com/axios/axios/releases/tag/v0.30.3

GHSA-43fc-jf86-j433

FIXED npm-next >= 15.3.0-canary.0, < 15.3.6 GHSA-9qr9-h5gf-34mp CRITICAL

npm-next >= 15.3.0-canary.0, < 15.3.6 CODE_REPOSITORY/examples GHSA-9qr9-h5gf-34mp CRITICAL remediate by: 2026-10-03T14:05:15.305Z

https://github.com/commercelayer/examples/security/dependabot/299

Related URLs

GHSA-9qr9-h5gf-34mp

https://nvd.nist.gov/vuln/detail/CVE-2025-55182

GHSA-fv66-9v8q-g76r

GHSA-fmh4-wr37-44fp

GHSA-9qr9-h5gf-34mp

FIXED npm-next >= 15.5.0-canary.0, < 15.5.7 GHSA-9qr9-h5gf-34mp CRITICAL

npm-next >= 15.5.0-canary.0, < 15.5.7 CODE_REPOSITORY/examples GHSA-9qr9-h5gf-34mp CRITICAL remediate by: 2026-10-03T14:05:15.305Z

https://github.com/commercelayer/examples/security/dependabot/304

Related URLs

GHSA-9qr9-h5gf-34mp

https://nvd.nist.gov/vuln/detail/CVE-2025-55182

GHSA-fv66-9v8q-g76r

GHSA-fmh4-wr37-44fp

GHSA-9qr9-h5gf-34mp

FIXED npm-next >= 13.0.0, < 13.5.9 CVE-2025-29927 CRITICAL

npm-next >= 13.0.0, < 13.5.9 CODE_REPOSITORY/examples CVE-2025-29927 CRITICAL remediate by: 2026-10-03T14:05:15.305Z

https://github.com/commercelayer/examples/security/dependabot/96

Related URLs

GHSA-f82v-jwr5-mffw

vercel/next.js@52a078d

vercel/next.js@5fd3ae8

https://nvd.nist.gov/vuln/detail/CVE-2025-29927

https://github.com/vercel/next.js/releases/tag/v12.3.5

https://github.com/vercel/next.js/releases/tag/v13.5.9

https://vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware

http://www.openwall.com/lists/oss-security/2025/03/23/3

http://www.openwall.com/lists/oss-security/2025/03/23/4

https://security.netapp.com/advisory/ntap-20250328-0002

GHSA-f82v-jwr5-mffw

FIXED npm-next >= 14.0.0, < 14.2.25 CVE-2025-29927 CRITICAL

npm-next >= 14.0.0, < 14.2.25 CODE_REPOSITORY/examples CVE-2025-29927 CRITICAL remediate by: 2026-10-03T14:05:15.305Z

https://github.com/commercelayer/examples/security/dependabot/187

Related URLs

GHSA-f82v-jwr5-mffw

vercel/next.js@52a078d

vercel/next.js@5fd3ae8

https://nvd.nist.gov/vuln/detail/CVE-2025-29927

https://github.com/vercel/next.js/releases/tag/v12.3.5

https://github.com/vercel/next.js/releases/tag/v13.5.9

https://vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware

http://www.openwall.com/lists/oss-security/2025/03/23/3

http://www.openwall.com/lists/oss-security/2025/03/23/4

https://security.netapp.com/advisory/ntap-20250328-0002

GHSA-f82v-jwr5-mffw

FIXED npm-shell-quote >= 1.1.0, <= 1.8.3 CVE-2026-9277 CRITICAL

npm-shell-quote >= 1.1.0, <= 1.8.3 CODE_REPOSITORY/examples CVE-2026-9277 CRITICAL remediate by: 2026-10-03T14:05:15.305Z

https://github.com/commercelayer/examples/security/dependabot/830

Related URLs

GHSA-w7jw-789q-3m8p

https://nvd.nist.gov/vuln/detail/CVE-2026-9277

ljharb/shell-quote@1518179

https://github.com/ljharb/shell-quote

https://www.npmjs.com/package/shell-quote

http://www.openwall.com/lists/oss-security/2026/05/23/2

GHSA-w7jw-789q-3m8p

FIXED npm-form-data >= 4.0.0, < 4.0.4 CVE-2025-7783 CRITICAL

npm-form-data >= 4.0.0, < 4.0.4 CODE_REPOSITORY/examples CVE-2025-7783 CRITICAL remediate by: 2026-10-03T14:05:15.305Z

https://github.com/commercelayer/examples/security/dependabot/213

Related URLs

GHSA-fjxv-7rqg-78g4

https://nvd.nist.gov/vuln/detail/CVE-2025-7783

form-data/form-data@3d17230

https://github.com/benweissmann/CVE-2025-7783-poc

https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html

GHSA-fjxv-7rqg-78g4

FIXED npm-form-data < 2.5.4 CVE-2025-7783 CRITICAL

npm-form-data < 2.5.4 CODE_REPOSITORY/examples CVE-2025-7783 CRITICAL remediate by: 2026-10-03T14:05:15.305Z

https://github.com/commercelayer/examples/security/dependabot/216

Related URLs

GHSA-fjxv-7rqg-78g4

https://nvd.nist.gov/vuln/detail/CVE-2025-7783

form-data/form-data@3d17230

https://github.com/benweissmann/CVE-2025-7783-poc

https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html

GHSA-fjxv-7rqg-78g4

FIXED npm-h3 <= 1.15.4 CVE-2026-23527 HIGH

npm-h3 <= 1.15.4 CODE_REPOSITORY/examples CVE-2026-23527 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/329

Related URLs

GHSA-mp2g-9vg9-f4cg

https://github.com/h3js/h3/releases/tag/v1.15.5

https://nvd.nist.gov/vuln/detail/CVE-2026-23527

h3js/h3@618ccf4

https://simonkoeck.com/writeups/h3-transfer-encoding-request-smuggling

GHSA-mp2g-9vg9-f4cg

FIXED npm-next >= 13.4.13, < 15.5.16 CVE-2026-44578 HIGH

npm-next >= 13.4.13, < 15.5.16 CODE_REPOSITORY/examples CVE-2026-44578 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/717

Related URLs

GHSA-c4j6-fc7j-m34r

https://github.com/vercel/next.js/releases/tag/v15.5.16

https://github.com/vercel/next.js/releases/tag/v16.2.5

https://nvd.nist.gov/vuln/detail/CVE-2026-44578

GHSA-c4j6-fc7j-m34r

FIXED npm-axios <= 0.31.1 CVE-2026-44492 HIGH

npm-axios <= 0.31.1 CODE_REPOSITORY/examples CVE-2026-44492 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/828

Related URLs

GHSA-pjwm-pj3p-43mv

https://nvd.nist.gov/vuln/detail/CVE-2025-62718

https://nvd.nist.gov/vuln/detail/CVE-2026-44492

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json

https://bugzilla.redhat.com/show_bug.cgi?id=2487938

https://access.redhat.com/security/cve/CVE-2026-44492

https://access.redhat.com/errata/RHSA-2026:36108

https://access.redhat.com/errata/RHSA-2026:33574

https://access.redhat.com/errata/RHSA-2026:33183

https://access.redhat.com/errata/RHSA-2026:33173

https://access.redhat.com/errata/RHSA-2026:33163

https://access.redhat.com/errata/RHSA-2026:33160

https://access.redhat.com/errata/RHSA-2026:33155

https://access.redhat.com/errata/RHSA-2026:33005

https://access.redhat.com/errata/RHSA-2026:30651

https://access.redhat.com/errata/RHSA-2026:30650

https://access.redhat.com/errata/RHSA-2026:29197

https://access.redhat.com/errata/RHSA-2026:29082

https://access.redhat.com/errata/RHSA-2026:28964

https://access.redhat.com/errata/RHSA-2026:27063

https://access.redhat.com/errata/RHSA-2026:27044

https://access.redhat.com/errata/RHSA-2026:26234

https://access.redhat.com/errata/RHSA-2026:20938

https://access.redhat.com/errata/RHSA-2026:20889

https://access.redhat.com/errata/RHSA-2026:36883

https://access.redhat.com/errata/RHSA-2026:36882

https://access.redhat.com/errata/RHSA-2026:36820

https://access.redhat.com/errata/RHSA-2026:36754

https://access.redhat.com/errata/RHSA-2026:34766

https://access.redhat.com/errata/RHSA-2026:36611

https://access.redhat.com/errata/RHSA-2026:40119

https://access.redhat.com/errata/RHSA-2026:40138

https://access.redhat.com/errata/RHSA-2026:40262

https://access.redhat.com/errata/RHSA-2026:41031

https://access.redhat.com/errata/RHSA-2026:41066

https://access.redhat.com/errata/RHSA-2026:41055

https://access.redhat.com/errata/RHSA-2026:41064

GHSA-pjwm-pj3p-43mv

FIXED npm-axios <= 0.31.1 CVE-2026-44486 HIGH

npm-axios <= 0.31.1 CODE_REPOSITORY/examples CVE-2026-44486 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/813

Related URLs

GHSA-j5f8-grm9-p9fc

fix: clear stale header on redirect when target is no-proxy axios/axios#10794

axios/axios@afca61a

https://github.com/axios/axios/releases/tag/v0.32.0

https://github.com/axios/axios/releases/tag/v1.16.0

https://nvd.nist.gov/vuln/detail/CVE-2026-44486

GHSA-j5f8-grm9-p9fc

FIXED npm-axios <= 0.31.1 CVE-2026-44496 HIGH

npm-axios <= 0.31.1 CODE_REPOSITORY/examples CVE-2026-44496 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/814

Related URLs

GHSA-hfxv-24rg-xrqf

https://github.com/axios/axios/releases/tag/v0.32.0

https://github.com/axios/axios/releases/tag/v1.16.0

GHSA-hfxv-24rg-xrqf

FIXED npm-axios <= 0.31.1 CVE-2026-44487 HIGH

npm-axios <= 0.31.1 CODE_REPOSITORY/examples CVE-2026-44487 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/815

Related URLs

GHSA-p92q-9vqr-4j8v

https://github.com/axios/axios/releases/tag/v0.32.0

https://github.com/axios/axios/releases/tag/v1.16.0

https://nvd.nist.gov/vuln/detail/CVE-2026-44487

GHSA-p92q-9vqr-4j8v

FIXED npm-axios <= 0.31.1 CVE-2026-44490 MEDIUM

npm-axios <= 0.31.1 CODE_REPOSITORY/examples CVE-2026-44490 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/789

Related URLs

GHSA-898c-q2cr-xwhg

https://nvd.nist.gov/vuln/detail/CVE-2018-16487

https://nvd.nist.gov/vuln/detail/CVE-2026-44490

GHSA-898c-q2cr-xwhg

FIXED npm-lodash >= 4.0.0, <= 4.17.23 CVE-2026-4800 HIGH

npm-lodash >= 4.0.0, <= 4.17.23 CODE_REPOSITORY/examples CVE-2026-4800 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/527

Related URLs

GHSA-r5fr-rjxr-66jc

https://nvd.nist.gov/vuln/detail/CVE-2026-4800

lodash/lodash@3469357

https://cna.openjsf.org/security-advisories.html

GHSA-35jh-r3h4-6jhm

GHSA-r5fr-rjxr-66jc

FIXED npm-next >= 15.4.0, < 15.5.16 CVE-2026-44574 HIGH

npm-next >= 15.4.0, < 15.5.16 CODE_REPOSITORY/examples CVE-2026-44574 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/661

Related URLs

GHSA-492v-c6pp-mqqv

https://github.com/vercel/next.js/releases/tag/v15.5.16

https://github.com/vercel/next.js/releases/tag/v16.2.5

https://nvd.nist.gov/vuln/detail/CVE-2026-44574

GHSA-492v-c6pp-mqqv

FIXED npm-ws >= 7.0.0, < 7.5.10 CVE-2024-37890 HIGH

npm-ws >= 7.0.0, < 7.5.10 CODE_REPOSITORY/examples CVE-2024-37890 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/73

Related URLs

GHSA-3h5v-q93c-6h6q

Throws TypeError when there are too many HTTP headers websockets/ws#2230

Fix crash when the Upgrade header cannot be read websockets/ws#2231

websockets/ws@22c2876

websockets/ws@4abd8f6

websockets/ws@e55e510

websockets/ws@eeb76d3

GHSA-3h5v-q93c-6h6q

FIXED npm-path-to-regexp >= 4.0.0, < 6.3.0 CVE-2024-45296 HIGH

npm-path-to-regexp >= 4.0.0, < 6.3.0 CODE_REPOSITORY/examples CVE-2024-45296 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/83

Related URLs

GHSA-9wv6-86v2-598j

pillarjs/path-to-regexp@29b96b4

pillarjs/path-to-regexp@60f2121

https://nvd.nist.gov/vuln/detail/CVE-2024-45296

pillarjs/path-to-regexp@925ac8e

pillarjs/path-to-regexp@d31670a

pillarjs/path-to-regexp@f1253b4

https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0

https://security.netapp.com/advisory/ntap-20250124-0001

GHSA-9wv6-86v2-598j

FIXED npm-body-parser < 1.20.3 CVE-2024-45590 HIGH

npm-body-parser < 1.20.3 CODE_REPOSITORY/examples CVE-2024-45590 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/201

Related URLs

GHSA-qwcr-r2fm-qrc7

expressjs/body-parser@b2695c4

https://nvd.nist.gov/vuln/detail/CVE-2024-45590

GHSA-qwcr-r2fm-qrc7

FIXED npm-next >= 9.5.5, < 14.2.15 CVE-2024-51479 HIGH

npm-next >= 9.5.5, < 14.2.15 CODE_REPOSITORY/examples CVE-2024-51479 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/185

Related URLs

GHSA-7gfc-8cq8-jh5f

vercel/next.js@1c8234e

https://nvd.nist.gov/vuln/detail/CVE-2024-51479

https://github.com/vercel/next.js/releases/tag/v14.2.15

GHSA-7gfc-8cq8-jh5f

FIXED npm-cross-spawn >= 7.0.0, < 7.0.5 CVE-2024-21538 HIGH

npm-cross-spawn >= 7.0.0, < 7.0.5 CODE_REPOSITORY/examples CVE-2024-21538 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/165

Related URLs

https://nvd.nist.gov/vuln/detail/CVE-2024-21538

fix: disable regexp backtracking moxystudio/node-cross-spawn#160

moxystudio/node-cross-spawn@5ff3a07

moxystudio/node-cross-spawn@640d391

https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230

Backport GHSA-3xgq-45jj-v275 moxystudio/node-cross-spawn#165

moxystudio/node-cross-spawn@d35c865

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349

GHSA-3xgq-45jj-v275

FIXED npm-path-to-regexp < 0.1.10 CVE-2024-45296 HIGH

npm-path-to-regexp < 0.1.10 CODE_REPOSITORY/examples CVE-2024-45296 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/200

Related URLs

GHSA-9wv6-86v2-598j

pillarjs/path-to-regexp@29b96b4

pillarjs/path-to-regexp@60f2121

https://nvd.nist.gov/vuln/detail/CVE-2024-45296

pillarjs/path-to-regexp@925ac8e

pillarjs/path-to-regexp@d31670a

pillarjs/path-to-regexp@f1253b4

https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0

https://security.netapp.com/advisory/ntap-20250124-0001

GHSA-9wv6-86v2-598j

FIXED npm-path-to-regexp < 0.1.12 CVE-2024-52798 HIGH

npm-path-to-regexp < 0.1.12 CODE_REPOSITORY/examples CVE-2024-52798 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/206

Related URLs

GHSA-rhx6-c78j-4q9w

https://blakeembrey.com/posts/2024-09-web-redos

https://nvd.nist.gov/vuln/detail/CVE-2024-52798

pillarjs/path-to-regexp@f01c26a

https://security.netapp.com/advisory/ntap-20250124-0002

GHSA-rhx6-c78j-4q9w

FIXED npm-braces < 3.0.3 CVE-2024-4068 HIGH

npm-braces < 3.0.3 CODE_REPOSITORY/examples CVE-2024-4068 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/158

Related URLs

https://nvd.nist.gov/vuln/detail/CVE-2024-4068

CWE-400 | Uncontrolled resource consumption micromatch/braces#35

https://devhub.checkmarx.com/cve-details/CVE-2024-4068

https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308

fix: vulnerability micromatch/braces#37

Reduce maxLength default to 10,000 and revert maxSymbols change micromatch/braces#40

micromatch/braces@415d660

GHSA-grv7-fg5c-xmjg

FIXED npm-next >= 14.0.0, < 14.2.10 CVE-2024-46982 HIGH

npm-next >= 14.0.0, < 14.2.10 CODE_REPOSITORY/examples CVE-2024-46982 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/181

Related URLs

GHSA-gp8f-8m3g-qvj9

vercel/next.js@7ed7f12

vercel/next.js@bd164d5

https://nvd.nist.gov/vuln/detail/CVE-2024-46982

GHSA-gp8f-8m3g-qvj9

FIXED npm-glob >= 10.2.0, < 10.5.0 CVE-2025-64756 HIGH

npm-glob >= 10.2.0, < 10.5.0 CODE_REPOSITORY/examples CVE-2025-64756 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/290

Related URLs

GHSA-5j98-mcp5-4vw2

isaacs/node-glob@47473c0

https://nvd.nist.gov/vuln/detail/CVE-2025-64756

isaacs/node-glob@1e4e297

GHSA-5j98-mcp5-4vw2

FIXED npm-jws < 3.2.3 CVE-2025-65945 HIGH

npm-jws < 3.2.3 CODE_REPOSITORY/examples CVE-2025-65945 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/302

Related URLs

GHSA-869p-cjfg-cm3x

auth0/node-jws@34c45b2

auth0/node-jws@4f6e73f

https://github.com/auth0/node-jws/releases/tag/v3.2.3

https://github.com/auth0/node-jws/releases/tag/v4.0.1

https://nvd.nist.gov/vuln/detail/CVE-2025-65945

GHSA-869p-cjfg-cm3x

FIXED npm-next >= 15.5.1-canary.0, < 15.5.8 GHSA-mwv6-3258-q52c HIGH

npm-next >= 15.5.1-canary.0, < 15.5.8 CODE_REPOSITORY/examples GHSA-mwv6-3258-q52c HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/311

Related URLs

GHSA-mwv6-3258-q52c

https://nextjs.org/blog/security-update-2025-12-11

https://www.cve.org/CVERecord?id=CVE-2025-55184

GHSA-mwv6-3258-q52c

FIXED npm-next >= 15.5.1-canary.0, < 15.5.8 GHSA-w37m-7fhw-fmv9 MEDIUM

npm-next >= 15.5.1-canary.0, < 15.5.8 CODE_REPOSITORY/examples GHSA-w37m-7fhw-fmv9 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/309

Related URLs

GHSA-w37m-7fhw-fmv9

https://nextjs.org/blog/security-update-2025-12-11

https://www.cve.org/CVERecord?id=CVE-2025-55183

GHSA-w37m-7fhw-fmv9

FIXED npm-next >= 15.3.0-canary.0, < 15.3.7 GHSA-mwv6-3258-q52c HIGH

npm-next >= 15.3.0-canary.0, < 15.3.7 CODE_REPOSITORY/examples GHSA-mwv6-3258-q52c HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/315

Related URLs

GHSA-mwv6-3258-q52c

https://nextjs.org/blog/security-update-2025-12-11

https://www.cve.org/CVERecord?id=CVE-2025-55184

GHSA-mwv6-3258-q52c

FIXED npm-next >= 15.3.0-canary.0, < 15.3.7 GHSA-w37m-7fhw-fmv9 MEDIUM

npm-next >= 15.3.0-canary.0, < 15.3.7 CODE_REPOSITORY/examples GHSA-w37m-7fhw-fmv9 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/313

Related URLs

GHSA-w37m-7fhw-fmv9

https://nextjs.org/blog/security-update-2025-12-11

https://www.cve.org/CVERecord?id=CVE-2025-55183

GHSA-w37m-7fhw-fmv9

FIXED npm-next >= 13.3.0, < 14.2.34 GHSA-mwv6-3258-q52c HIGH

npm-next >= 13.3.0, < 14.2.34 CODE_REPOSITORY/examples GHSA-mwv6-3258-q52c HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/317

Related URLs

GHSA-mwv6-3258-q52c

https://nextjs.org/blog/security-update-2025-12-11

https://www.cve.org/CVERecord?id=CVE-2025-55184

GHSA-mwv6-3258-q52c

FIXED npm-next >= 13.3.1-canary.0, < 14.2.35 GHSA-5j59-xgg2-r9c4 HIGH

npm-next >= 13.3.1-canary.0, < 14.2.35 CODE_REPOSITORY/examples GHSA-5j59-xgg2-r9c4 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/319

Related URLs

GHSA-5j59-xgg2-r9c4

https://nvd.nist.gov/vuln/detail/CVE-2025-67779

https://nextjs.org/blog/security-update-2025-12-11

https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

https://www.cve.org/CVERecord?id=CVE-2025-55184

https://www.facebook.com/security/advisories/cve-2025-67779

GHSA-5j59-xgg2-r9c4

FIXED npm-next >= 15.5.1-canary.0, < 15.5.10 GHSA-h25m-26qc-wcjf HIGH

npm-next >= 15.5.1-canary.0, < 15.5.10 CODE_REPOSITORY/examples GHSA-h25m-26qc-wcjf HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/341

Related URLs

GHSA-83fc-fqcc-2hmg

GHSA-h25m-26qc-wcjf

https://nvd.nist.gov/vuln/detail/CVE-2026-23864

https://vercel.com/changelog/summary-of-cve-2026-23864

GHSA-h25m-26qc-wcjf

FIXED npm-next >= 15.3.0-canary.0, < 15.3.9 GHSA-h25m-26qc-wcjf HIGH

npm-next >= 15.3.0-canary.0, < 15.3.9 CODE_REPOSITORY/examples GHSA-h25m-26qc-wcjf HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/343

Related URLs

GHSA-83fc-fqcc-2hmg

GHSA-h25m-26qc-wcjf

https://nvd.nist.gov/vuln/detail/CVE-2026-23864

https://vercel.com/changelog/summary-of-cve-2026-23864

GHSA-h25m-26qc-wcjf

FIXED npm-next >= 13.0.0, < 15.0.8 GHSA-h25m-26qc-wcjf HIGH

npm-next >= 13.0.0, < 15.0.8 CODE_REPOSITORY/examples GHSA-h25m-26qc-wcjf HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/357

Related URLs

GHSA-83fc-fqcc-2hmg

GHSA-h25m-26qc-wcjf

https://nvd.nist.gov/vuln/detail/CVE-2026-23864

https://vercel.com/changelog/summary-of-cve-2026-23864

GHSA-h25m-26qc-wcjf

FIXED npm-axios <= 0.30.2 CVE-2026-25639 HIGH

npm-axios <= 0.30.2 CODE_REPOSITORY/examples CVE-2026-25639 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/400

Related URLs

GHSA-43fc-jf86-j433

Fix Denial of Service via __proto__ Key in mergeConfig axios/axios#7369

axios/axios@28c7215

https://github.com/axios/axios/releases/tag/v1.13.5

https://nvd.nist.gov/vuln/detail/CVE-2026-25639

fix: backport DOS via __proto__ key in merge config fix to v0.x axios/axios#7388

axios/axios@d7ff140

https://github.com/axios/axios/releases/tag/v0.30.3

GHSA-43fc-jf86-j433

FIXED npm-minimatch < 3.1.3 CVE-2026-27903 HIGH

npm-minimatch < 3.1.3 CODE_REPOSITORY/examples CVE-2026-27903 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/425

Related URLs

GHSA-7r86-cg39-jmmj

https://nvd.nist.gov/vuln/detail/CVE-2026-27903

isaacs/minimatch@0bf499a

GHSA-7r86-cg39-jmmj

FIXED npm-minimatch < 3.1.3 CVE-2026-26996 HIGH

npm-minimatch < 3.1.3 CODE_REPOSITORY/examples CVE-2026-26996 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/411

Related URLs

GHSA-3ppc-4f35-3m26

isaacs/minimatch@2e111f3

https://nvd.nist.gov/vuln/detail/CVE-2026-26996

GHSA-3ppc-4f35-3m26

FIXED npm-minimatch < 3.1.4 CVE-2026-27904 HIGH

npm-minimatch < 3.1.4 CODE_REPOSITORY/examples CVE-2026-27904 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/432

Related URLs

GHSA-23c5-xmqv-rm74

https://nvd.nist.gov/vuln/detail/CVE-2026-27904

isaacs/minimatch@11d0df6

GHSA-23c5-xmqv-rm74

FIXED npm-minimatch >= 9.0.0, < 9.0.7 CVE-2026-27903 HIGH

npm-minimatch >= 9.0.0, < 9.0.7 CODE_REPOSITORY/examples CVE-2026-27903 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/436

Related URLs

GHSA-7r86-cg39-jmmj

https://nvd.nist.gov/vuln/detail/CVE-2026-27903

isaacs/minimatch@0bf499a

GHSA-7r86-cg39-jmmj

FIXED npm-minimatch >= 9.0.0, < 9.0.7 CVE-2026-27904 HIGH

npm-minimatch >= 9.0.0, < 9.0.7 CODE_REPOSITORY/examples CVE-2026-27904 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/439

Related URLs

GHSA-23c5-xmqv-rm74

https://nvd.nist.gov/vuln/detail/CVE-2026-27904

isaacs/minimatch@11d0df6

GHSA-23c5-xmqv-rm74

FIXED npm-h3 < 1.15.6 CVE-2026-33128 HIGH

npm-h3 < 1.15.6 CODE_REPOSITORY/examples CVE-2026-33128 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/453

Related URLs

GHSA-22cc-p3c6-wpvm

h3js/h3@7791538

https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187

https://nvd.nist.gov/vuln/detail/CVE-2026-33128

GHSA-22cc-p3c6-wpvm

FIXED npm-h3 < 1.15.6 GHSA-wr4h-v87w-p3r7 MEDIUM

npm-h3 < 1.15.6 CODE_REPOSITORY/examples GHSA-wr4h-v87w-p3r7 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/452

Related URLs

GHSA-wr4h-v87w-p3r7

h3js/h3@0e751b4

https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/static.ts#L86

GHSA-wr4h-v87w-p3r7

FIXED npm-picomatch < 2.3.2 CVE-2026-33671 HIGH

npm-picomatch < 2.3.2 CODE_REPOSITORY/examples CVE-2026-33671 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/490

Related URLs

GHSA-c2c7-rcm5-vvqj

micromatch/picomatch@5eceecd

https://nvd.nist.gov/vuln/detail/CVE-2026-33671

GHSA-c2c7-rcm5-vvqj

FIXED npm-picomatch < 2.3.2 CVE-2026-33672 MEDIUM

npm-picomatch < 2.3.2 CODE_REPOSITORY/examples CVE-2026-33672 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/496

Related URLs

GHSA-3v7f-55p6-f55p

micromatch/picomatch@4516eb5

https://nvd.nist.gov/vuln/detail/CVE-2026-33672

GHSA-3v7f-55p6-f55p

FIXED npm-path-to-regexp < 0.1.13 CVE-2026-4867 HIGH

npm-path-to-regexp < 0.1.13 CODE_REPOSITORY/examples CVE-2026-4867 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/513

Related URLs

GHSA-37ch-88jc-xwx2

https://nvd.nist.gov/vuln/detail/CVE-2026-4867

https://blakeembrey.com/posts/2024-09-web-redos

https://cna.openjsf.org/security-advisories.html

GHSA-9wv6-86v2-598j

https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13

GHSA-37ch-88jc-xwx2

FIXED npm-defu <= 6.1.4 CVE-2026-35209 HIGH

npm-defu <= 6.1.4 CODE_REPOSITORY/examples CVE-2026-35209 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/514

Related URLs

GHSA-737v-mqg7-c878

https://nvd.nist.gov/vuln/detail/CVE-2026-35209

fix: prevent prototype pollution via __proto__ unjs/defu#156

unjs/defu@3942bfb

https://github.com/unjs/defu/releases/tag/v6.1.5

GHSA-737v-mqg7-c878

FIXED npm-next >= 13.0.0, < 15.5.15 GHSA-q4gf-8mx6-v5v3 HIGH

npm-next >= 13.0.0, < 15.5.15 CODE_REPOSITORY/examples GHSA-q4gf-8mx6-v5v3 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/553

Related URLs

GHSA-q4gf-8mx6-v5v3

https://vercel.com/changelog/summary-of-cve-2026-23869

GHSA-q4gf-8mx6-v5v3

FIXED npm-next >= 15.2.0, < 15.5.18 CVE-2026-45109 HIGH

npm-next >= 15.2.0, < 15.5.18 CODE_REPOSITORY/examples CVE-2026-45109 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/671

Related URLs

GHSA-267c-6grr-h53f

GHSA-26hh-7cqf-hhc6

https://github.com/vercel/next.js/releases/tag/v15.5.18

https://github.com/vercel/next.js/releases/tag/v16.2.6

https://nvd.nist.gov/vuln/detail/CVE-2026-45109

GHSA-26hh-7cqf-hhc6

FIXED npm-next >= 15.2.0, < 15.5.16 CVE-2026-44575 HIGH

npm-next >= 15.2.0, < 15.5.16 CODE_REPOSITORY/examples CVE-2026-44575 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/669

Related URLs

GHSA-267c-6grr-h53f

https://github.com/vercel/next.js/releases/tag/v15.5.16

https://github.com/vercel/next.js/releases/tag/v16.2.5

https://nvd.nist.gov/vuln/detail/CVE-2026-44575

GHSA-267c-6grr-h53f

FIXED npm-next >= 15.0.0, < 15.5.16 CVE-2026-44579 HIGH

npm-next >= 15.0.0, < 15.5.16 CODE_REPOSITORY/examples CVE-2026-44579 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/675

Related URLs

GHSA-mg66-mrh9-m8jx

https://github.com/vercel/next.js/releases/tag/v15.5.16

https://github.com/vercel/next.js/releases/tag/v16.2.5

https://nvd.nist.gov/vuln/detail/CVE-2026-44579

GHSA-mg66-mrh9-m8jx

FIXED npm-next >= 13.0.0, < 15.5.16 GHSA-8h8q-6873-q5fj HIGH

npm-next >= 13.0.0, < 15.5.16 CODE_REPOSITORY/examples GHSA-8h8q-6873-q5fj HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/729

Related URLs

GHSA-rv78-f8rc-xrxh

GHSA-8h8q-6873-q5fj

GHSA-w94c-4vhp-22gx

https://nvd.nist.gov/vuln/detail/CVE-2026-23870

GHSA-8h8q-6873-q5fj

FIXED npm-next >= 13.0.0, < 15.5.16 CVE-2026-44580 MEDIUM

npm-next >= 13.0.0, < 15.5.16 CODE_REPOSITORY/examples CVE-2026-44580 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/731

Related URLs

GHSA-gx5p-jg67-6x7h

https://github.com/vercel/next.js/releases/tag/v15.5.16

https://github.com/vercel/next.js/releases/tag/v16.2.5

https://nvd.nist.gov/vuln/detail/CVE-2026-44580

GHSA-gx5p-jg67-6x7h

FIXED npm-next >= 12.2.0, < 15.5.16 CVE-2026-44573 HIGH

npm-next >= 12.2.0, < 15.5.16 CODE_REPOSITORY/examples CVE-2026-44573 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/733

Related URLs

GHSA-36qx-fr4f-26g5

https://github.com/vercel/next.js/releases/tag/v15.5.16

https://github.com/vercel/next.js/releases/tag/v16.2.5

https://nvd.nist.gov/vuln/detail/CVE-2026-44573

GHSA-36qx-fr4f-26g5

FIXED npm-next >= 12.2.0, < 15.5.16 CVE-2026-44572 LOW

npm-next >= 12.2.0, < 15.5.16 CODE_REPOSITORY/examples CVE-2026-44572 LOW remediate by: 2026-12-02T14:05:20.740Z

https://github.com/commercelayer/examples/security/dependabot/737

Related URLs

GHSA-3g8h-86w9-wvmq

https://github.com/vercel/next.js/releases/tag/v15.5.16

https://github.com/vercel/next.js/releases/tag/v16.2.5

https://nvd.nist.gov/vuln/detail/CVE-2026-44572

GHSA-3g8h-86w9-wvmq

FIXED npm-axios >= 1.7.0, < 1.16.0 CVE-2026-44488 HIGH

npm-axios >= 1.7.0, < 1.16.0 CODE_REPOSITORY/examples CVE-2026-44488 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/793

Related URLs

GHSA-777c-7fjr-54vf

fix: fetch adaptor is not enforcing max body or content length axios/axios#10795

fix: incorrect assumption on test axios/axios#10796

https://github.com/axios/axios/releases/tag/v1.16.0

https://nvd.nist.gov/vuln/detail/CVE-2026-44488

GHSA-777c-7fjr-54vf

FIXED npm-form-data >= 4.0.0, < 4.0.6 CVE-2026-12143 HIGH

npm-form-data >= 4.0.0, < 4.0.6 CODE_REPOSITORY/examples CVE-2026-12143 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/863

Related URLs

GHSA-hmw2-7cc7-3qxx

https://nvd.nist.gov/vuln/detail/CVE-2026-12143

form-data/form-data@64190db

form-data/form-data@be3f3cf

form-data/form-data@c713349

https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data

https://www.npmjs.com/package/form-data

GHSA-hmw2-7cc7-3qxx

FIXED npm-vite >= 8.0.0, <= 8.0.15 CVE-2026-53571 HIGH

npm-vite >= 8.0.0, <= 8.0.15 CODE_REPOSITORY/examples CVE-2026-53571 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/848

Related URLs

GHSA-fx2h-pf6j-xcff

https://nvd.nist.gov/vuln/detail/CVE-2026-53571

GHSA-fx2h-pf6j-xcff

FIXED npm-vite >= 8.0.0, <= 8.0.15 CVE-2026-53632 MEDIUM

npm-vite >= 8.0.0, <= 8.0.15 CODE_REPOSITORY/examples CVE-2026-53632 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/849

Related URLs

GHSA-v6wh-96g9-6wx3

GHSA-v6wh-96g9-6wx3

FIXED npm-ws >= 7.0.0, < 7.5.11 CVE-2026-48779 HIGH

npm-ws >= 7.0.0, < 7.5.11 CODE_REPOSITORY/examples CVE-2026-48779 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/850

Related URLs

GHSA-96hv-2xvq-fx4p

websockets/ws@86d3e8a

websockets/ws@b5372ac

websockets/ws@bca91ad

websockets/ws@fd36cd8

https://nvd.nist.gov/vuln/detail/CVE-2026-48779

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json

https://bugzilla.redhat.com/show_bug.cgi?id=2489661

https://access.redhat.com/security/cve/CVE-2026-48779

https://access.redhat.com/errata/RHSA-2026:34342

https://access.redhat.com/errata/RHSA-2026:33574

https://access.redhat.com/errata/RHSA-2026:33183

https://access.redhat.com/errata/RHSA-2026:33173

https://access.redhat.com/errata/RHSA-2026:33163

https://access.redhat.com/errata/RHSA-2026:33160

https://access.redhat.com/errata/RHSA-2026:33155

https://access.redhat.com/errata/RHSA-2026:29197

https://access.redhat.com/errata/RHSA-2026:36820

https://access.redhat.com/errata/RHSA-2026:36754

https://access.redhat.com/errata/RHSA-2026:37272

https://access.redhat.com/errata/RHSA-2026:27171

https://access.redhat.com/errata/RHSA-2026:26638

GHSA-96hv-2xvq-fx4p

FIXED npm-form-data < 2.5.6 CVE-2026-12143 HIGH

npm-form-data < 2.5.6 CODE_REPOSITORY/examples CVE-2026-12143 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/859

Related URLs

GHSA-hmw2-7cc7-3qxx

https://nvd.nist.gov/vuln/detail/CVE-2026-12143

form-data/form-data@64190db

form-data/form-data@be3f3cf

form-data/form-data@c713349

https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data

https://www.npmjs.com/package/form-data

GHSA-hmw2-7cc7-3qxx

FIXED npm-shell-quote <= 1.8.4 CVE-2026-13311 HIGH

npm-shell-quote <= 1.8.4 CODE_REPOSITORY/examples CVE-2026-13311 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/935

Related URLs

GHSA-395f-4hp3-45gv

https://nvd.nist.gov/vuln/detail/CVE-2026-13311

ljharb/shell-quote@7ff5488

https://github.com/ljharb/shell-quote/releases/tag/v1.9.0

https://www.npmjs.com/package/shell-quote

GHSA-395f-4hp3-45gv

FIXED npm-postcss <= 8.5.11 CVE-2026-45623 HIGH

npm-postcss <= 8.5.11 CODE_REPOSITORY/examples CVE-2026-45623 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1002

Related URLs

GHSA-6g55-p6wh-862q

postcss/postcss@aaec7b7

postcss/postcss@c64b748

https://github.com/postcss/postcss/releases/tag/8.5.12

GHSA-6g55-p6wh-862q

FIXED npm-postcss <= 8.5.17 CVE-2026-73646 HIGH

npm-postcss <= 8.5.17 CODE_REPOSITORY/examples CVE-2026-73646 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1032

Related URLs

GHSA-r28c-9q8g-f849

postcss/postcss@95663d3

https://github.com/postcss/postcss/releases/tag/8.5.18

GHSA-r28c-9q8g-f849

FIXED npm-brace-expansion >= 2.0.0, < 2.1.3 CVE-2026-14257 HIGH

npm-brace-expansion >= 2.0.0, < 2.1.3 CODE_REPOSITORY/examples CVE-2026-14257 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1030

Related URLs

GHSA-mh99-v99m-4gvg

https://nvd.nist.gov/vuln/detail/CVE-2026-14257

juliangruber/brace-expansion@a1bd339

https://github.com/juliangruber/brace-expansion

https://www.npmjs.com/package/brace-expansion

fix: backport GHSA-mh99-v99m-4gvg juliangruber/brace-expansion#129

fix: backport GHSA-mh99-v99m-4gvg juliangruber/brace-expansion#130

fix: backport GHSA-mh99-v99m-4gvg to v3 juliangruber/brace-expansion#136

juliangruber/brace-expansion@139d015

juliangruber/brace-expansion@cb4b9e4

juliangruber/brace-expansion@d13ff45

GHSA-mh99-v99m-4gvg

REPO TAG SKIPPED (no releases)

CODE_REPOSITORY/examples

All the listed vulnerabilities are still detected.
Please resolve within 24 days.

No vulnerability is detected anymore.

Navigation Menu

Repository navigation

[VANTA] [VULNERABILITY] <HIGH> CVE-2026-46625, fix before 2026-10-03 #38

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[VANTA] [VULNERABILITY] <HIGH> CVE-2026-46625, fix before 2026-10-03 #38

Description

Activity

commercelayer-ci commented on Sep 9, 2026

commercelayer-ci commented on Sep 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions