[VANTA] [VULNERABILITY] <HIGH> CVE-2023-45857, CVE-2024-39338, CVE-2025-27152 and others, fix before 2026-10-03

Important

CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.

DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

FIXED npm-axios >= 1.0.0, < 1.15.2 CVE-2026-42264 HIGH

npm-axios >= 1.0.0, < 1.15.2 CODE_REPOSITORY/examples CVE-2026-42264 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/627

Related URLs

GHSA-q8qp-cvcw-x6jj

https://nvd.nist.gov/vuln/detail/CVE-2026-42264

fix: more header pollutions axios/axios#10779

axios/axios@4791514

https://github.com/axios/axios/releases/tag/v1.15.2

GHSA-q8qp-cvcw-x6jj

FIXED npm-axios >= 1.0.0, < 1.15.2 CVE-2026-44495 HIGH

npm-axios >= 1.0.0, < 1.15.2 CODE_REPOSITORY/examples CVE-2026-44495 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/821

Related URLs

GHSA-3g43-6gmg-66jw

https://nvd.nist.gov/vuln/detail/CVE-2026-44495

GHSA-3g43-6gmg-66jw

FIXED npm-axios >= 1.0.0, < 1.15.2 CVE-2026-42044 MEDIUM

npm-axios >= 1.0.0, < 1.15.2 CODE_REPOSITORY/examples CVE-2026-42044 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/631

Related URLs

GHSA-3w6x-2g7m-8v23

https://nvd.nist.gov/vuln/detail/CVE-2026-42044

GHSA-3w6x-2g7m-8v23

FIXED npm-axios >= 1.0.0, < 1.15.1 CVE-2026-42035 HIGH

npm-axios >= 1.0.0, < 1.15.1 CODE_REPOSITORY/examples CVE-2026-42035 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/633

Related URLs

GHSA-6chq-wfr3-2hj9

https://nvd.nist.gov/vuln/detail/CVE-2026-42035

GHSA-6chq-wfr3-2hj9

FIXED npm-axios >= 1.0.0, < 1.15.1 CVE-2026-42033 HIGH

npm-axios >= 1.0.0, < 1.15.1 CODE_REPOSITORY/examples CVE-2026-42033 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/637

Related URLs

GHSA-pf86-5x62-jrwf

https://nvd.nist.gov/vuln/detail/CVE-2026-42033

GHSA-pf86-5x62-jrwf

FIXED npm-axios >= 1.0.0, < 1.15.1 CVE-2026-42043 HIGH

npm-axios >= 1.0.0, < 1.15.1 CODE_REPOSITORY/examples CVE-2026-42043 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/711

Related URLs

GHSA-pmwg-cvhr-8vh7

https://nvd.nist.gov/vuln/detail/CVE-2026-42043

GHSA-pmwg-cvhr-8vh7

FIXED npm-axios >= 1.0.0, < 1.15.1 CVE-2026-42039 MEDIUM

npm-axios >= 1.0.0, < 1.15.1 CODE_REPOSITORY/examples CVE-2026-42039 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/641

Related URLs

GHSA-62hf-57xw-28j9

https://nvd.nist.gov/vuln/detail/CVE-2026-42039

axios/axios@85132ff

https://github.com/axios/axios/releases/tag/v1.15.1

GHSA-62hf-57xw-28j9

FIXED npm-axios >= 1.0.0, < 1.15.1 CVE-2026-42038 MEDIUM

npm-axios >= 1.0.0, < 1.15.1 CODE_REPOSITORY/examples CVE-2026-42038 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/639

Related URLs

GHSA-m7pr-hjqh-92cm

https://nvd.nist.gov/vuln/detail/CVE-2026-42038

GHSA-m7pr-hjqh-92cm

FIXED npm-axios >= 1.0.0, < 1.15.1 CVE-2026-42042 MEDIUM

npm-axios >= 1.0.0, < 1.15.1 CODE_REPOSITORY/examples CVE-2026-42042 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/709

Related URLs

GHSA-xx6v-rp6x-q39c

https://nvd.nist.gov/vuln/detail/CVE-2026-42042

GHSA-xx6v-rp6x-q39c

FIXED npm-axios >= 1.0.0, < 1.15.1 CVE-2026-42036 MEDIUM

npm-axios >= 1.0.0, < 1.15.1 CODE_REPOSITORY/examples CVE-2026-42036 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/635

Related URLs

GHSA-vf2m-468p-8v99

https://nvd.nist.gov/vuln/detail/CVE-2026-42036

GHSA-vf2m-468p-8v99

FIXED npm-axios >= 1.0.0, < 1.15.1 CVE-2026-42034 MEDIUM

npm-axios >= 1.0.0, < 1.15.1 CODE_REPOSITORY/examples CVE-2026-42034 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/645

Related URLs

GHSA-5c9x-8gcm-mpgx

https://nvd.nist.gov/vuln/detail/CVE-2026-42034

GHSA-5c9x-8gcm-mpgx

FIXED npm-axios >= 1.0.0, < 1.15.1 CVE-2026-42037 MEDIUM

npm-axios >= 1.0.0, < 1.15.1 CODE_REPOSITORY/examples CVE-2026-42037 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/643

Related URLs

GHSA-445q-vr5w-6q77

https://nvd.nist.gov/vuln/detail/CVE-2026-42037

GHSA-445q-vr5w-6q77

FIXED npm-axios >= 1.0.0, < 1.15.1 CVE-2026-42041 MEDIUM

npm-axios >= 1.0.0, < 1.15.1 CODE_REPOSITORY/examples CVE-2026-42041 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/773

Related URLs

GHSA-w9j2-pvgh-6h63

https://nvd.nist.gov/vuln/detail/CVE-2026-42041

GHSA-w9j2-pvgh-6h63

FIXED npm-axios >= 1.0.0, < 1.15.1 CVE-2026-42040 LOW

npm-axios >= 1.0.0, < 1.15.1 CODE_REPOSITORY/examples CVE-2026-42040 LOW remediate by: 2026-12-02T14:05:20.740Z

https://github.com/commercelayer/examples/security/dependabot/629

Related URLs

GHSA-xhjh-pmcv-23jw

https://nvd.nist.gov/vuln/detail/CVE-2026-42040

GHSA-xhjh-pmcv-23jw

FIXED npm-axios >= 1.3.2, <= 1.7.3 CVE-2024-39338 HIGH

npm-axios >= 1.3.2, <= 1.7.3 CODE_REPOSITORY/examples CVE-2024-39338 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/199

Related URLs

https://nvd.nist.gov/vuln/detail/CVE-2024-39338

https://github.com/axios/axios/releases

https://jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.html

Server-Side Request Forgery Vulnerability (CVE-2024-39338) axios/axios#6463

fix(sec): disregard protocol-relative URL to remediate SSRF axios/axios#6539

fix(sec): CVE-2024-39338 (#6539) axios/axios#6543

axios/axios@6b6b605

https://github.com/axios/axios/releases/tag/v1.7.4

GHSA-8hc4-vh64-cxmj

FIXED npm-axios >= 1.0.0, < 1.8.2 CVE-2025-27152 HIGH

npm-axios >= 1.0.0, < 1.8.2 CODE_REPOSITORY/examples CVE-2025-27152 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/207

Related URLs

GHSA-jr5f-v2jv-69x6

Server-Side Request Forgery Vulnerability (CVE-2024-39338) axios/axios#6463

axios/axios@fb8eec2

https://github.com/axios/axios/releases/tag/v1.8.2

https://nvd.nist.gov/vuln/detail/CVE-2025-27152

Backport allowAbsoluteUrls vuln fix to v0.x axios/axios#6829

axios/axios@02c3c69

GHSA-jr5f-v2jv-69x6

FIXED npm-axios >= 1.0.0, < 1.6.0 CVE-2023-45857 MEDIUM

npm-axios >= 1.0.0, < 1.6.0 CODE_REPOSITORY/examples CVE-2023-45857 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/49

Related URLs

https://nvd.nist.gov/vuln/detail/CVE-2023-45857

CVE-2023-45857 (CWE-359) XSRF-TOKEN value is disclosed to an unauthorised actor axios/axios#6006

CSRF vulnerability in AXIOS 0.24.1 to latest axios/axios#6022

CVE 2023 45857 axios/axios#6028

axios/axios@96ee232

https://github.com/axios/axios/releases/tag/v1.6.0

https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

fix: resolve CVE-2023-45857 in v0.x branch axios/axios#6091

axios/axios@2755df5

https://github.com/axios/axios/releases/tag/v0.28.0

https://security.netapp.com/advisory/ntap-20240621-0006

GHSA-wf5p-g6vw-rhxx

FIXED npm-brace-expansion >= 2.0.0, < 2.1.4 CVE-2026-69152 HIGH

npm-brace-expansion >= 2.0.0, < 2.1.4 CODE_REPOSITORY/examples CVE-2026-69152 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1036

Related URLs

GHSA-rgw5-rvv9-x895

juliangruber/brace-expansion@139d015

juliangruber/brace-expansion@1e30c93

juliangruber/brace-expansion@688a99e

juliangruber/brace-expansion@cb4b9e4

https://nvd.nist.gov/vuln/detail/CVE-2026-69152

GHSA-rgw5-rvv9-x895

FIXED npm-brace-expansion < 1.1.17 CVE-2026-14257 HIGH

npm-brace-expansion < 1.1.17 CODE_REPOSITORY/examples CVE-2026-14257 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1050

Related URLs

GHSA-mh99-v99m-4gvg

https://nvd.nist.gov/vuln/detail/CVE-2026-14257

juliangruber/brace-expansion@a1bd339

https://github.com/juliangruber/brace-expansion

https://www.npmjs.com/package/brace-expansion

fix: backport GHSA-mh99-v99m-4gvg juliangruber/brace-expansion#129

fix: backport GHSA-mh99-v99m-4gvg juliangruber/brace-expansion#130

fix: backport GHSA-mh99-v99m-4gvg to v3 juliangruber/brace-expansion#136

juliangruber/brace-expansion@139d015

juliangruber/brace-expansion@cb4b9e4

juliangruber/brace-expansion@d13ff45

GHSA-mh99-v99m-4gvg

FIXED npm-brace-expansion < 1.1.18 CVE-2026-69152 HIGH

npm-brace-expansion < 1.1.18 CODE_REPOSITORY/examples CVE-2026-69152 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1089

Related URLs

GHSA-rgw5-rvv9-x895

juliangruber/brace-expansion@139d015

juliangruber/brace-expansion@1e30c93

juliangruber/brace-expansion@688a99e

juliangruber/brace-expansion@cb4b9e4

https://nvd.nist.gov/vuln/detail/CVE-2026-69152

GHSA-rgw5-rvv9-x895

FIXED npm-browserslist <= 4.28.6 CVE-2026-73088 HIGH

npm-browserslist <= 4.28.6 CODE_REPOSITORY/examples CVE-2026-73088 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1095

Related URLs

GHSA-73wf-gq98-2v4g

https://nvd.nist.gov/vuln/detail/CVE-2026-73088

browserslist/browserslist@f9914ad

https://github.com/browserslist/browserslist/releases/tag/4.28.7

GHSA-73wf-gq98-2v4g

FIXED npm-browserslist <= 4.28.6 CVE-2026-73089 HIGH

npm-browserslist <= 4.28.6 CODE_REPOSITORY/examples CVE-2026-73089 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1096

Related URLs

GHSA-c83g-rgw3-j3cx

https://nvd.nist.gov/vuln/detail/CVE-2026-73089

browserslist/browserslist@f2931a3

https://github.com/browserslist/browserslist/releases/tag/4.28.7

GHSA-c83g-rgw3-j3cx

FIXED npm-axios <= 0.31.0 CVE-2026-42033 HIGH

npm-axios <= 0.31.0 CODE_REPOSITORY/examples CVE-2026-42033 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/762

Related URLs

GHSA-pf86-5x62-jrwf

https://nvd.nist.gov/vuln/detail/CVE-2026-42033

GHSA-pf86-5x62-jrwf

FIXED npm-axios <= 0.31.0 CVE-2026-42035 HIGH

npm-axios <= 0.31.0 CODE_REPOSITORY/examples CVE-2026-42035 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/723

Related URLs

GHSA-6chq-wfr3-2hj9

https://nvd.nist.gov/vuln/detail/CVE-2026-42035

GHSA-6chq-wfr3-2hj9

FIXED npm-axios <= 0.31.0 CVE-2026-42043 HIGH

npm-axios <= 0.31.0 CODE_REPOSITORY/examples CVE-2026-42043 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/647

Related URLs

GHSA-pmwg-cvhr-8vh7

https://nvd.nist.gov/vuln/detail/CVE-2026-42043

GHSA-pmwg-cvhr-8vh7

FIXED npm-axios <= 0.31.0 CVE-2026-42039 MEDIUM

npm-axios <= 0.31.0 CODE_REPOSITORY/examples CVE-2026-42039 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/651

Related URLs

GHSA-62hf-57xw-28j9

https://nvd.nist.gov/vuln/detail/CVE-2026-42039

axios/axios@85132ff

https://github.com/axios/axios/releases/tag/v1.15.1

GHSA-62hf-57xw-28j9

FIXED npm-axios <= 0.31.0 CVE-2026-42038 MEDIUM

npm-axios <= 0.31.0 CODE_REPOSITORY/examples CVE-2026-42038 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/650

Related URLs

GHSA-m7pr-hjqh-92cm

https://nvd.nist.gov/vuln/detail/CVE-2026-42038

GHSA-m7pr-hjqh-92cm

FIXED npm-axios <= 0.31.0 CVE-2026-42042 MEDIUM

npm-axios <= 0.31.0 CODE_REPOSITORY/examples CVE-2026-42042 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/648

Related URLs

GHSA-xx6v-rp6x-q39c

https://nvd.nist.gov/vuln/detail/CVE-2026-42042

GHSA-xx6v-rp6x-q39c

FIXED npm-axios <= 0.31.0 CVE-2026-42036 MEDIUM

npm-axios <= 0.31.0 CODE_REPOSITORY/examples CVE-2026-42036 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/713

Related URLs

GHSA-vf2m-468p-8v99

https://nvd.nist.gov/vuln/detail/CVE-2026-42036

GHSA-vf2m-468p-8v99

FIXED npm-axios <= 0.31.0 CVE-2026-42034 MEDIUM

npm-axios <= 0.31.0 CODE_REPOSITORY/examples CVE-2026-42034 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/649

Related URLs

GHSA-5c9x-8gcm-mpgx

https://nvd.nist.gov/vuln/detail/CVE-2026-42034

GHSA-5c9x-8gcm-mpgx

FIXED npm-axios <= 0.31.0 CVE-2026-42041 MEDIUM

npm-axios <= 0.31.0 CODE_REPOSITORY/examples CVE-2026-42041 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/712

Related URLs

GHSA-w9j2-pvgh-6h63

https://nvd.nist.gov/vuln/detail/CVE-2026-42041

GHSA-w9j2-pvgh-6h63

FIXED npm-axios <= 0.31.0 CVE-2026-42040 LOW

npm-axios <= 0.31.0 CODE_REPOSITORY/examples CVE-2026-42040 LOW remediate by: 2026-12-02T14:05:20.740Z

https://github.com/commercelayer/examples/security/dependabot/646

Related URLs

GHSA-xhjh-pmcv-23jw

https://nvd.nist.gov/vuln/detail/CVE-2026-42040

GHSA-xhjh-pmcv-23jw

FIXED npm-nanoid < 3.3.12 CVE-2026-73086 HIGH

npm-nanoid < 3.3.12 CODE_REPOSITORY/examples CVE-2026-73086 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1098

Related URLs

GHSA-xwg4-73v4-xw9w

https://nvd.nist.gov/vuln/detail/CVE-2026-73086

ai/nanoid@7087969

ai/nanoid@821dfed

ai/nanoid@b0036ed

https://github.com/ai/nanoid/releases/tag/3.3.12

https://github.com/ai/nanoid/releases/tag/5.1.11

GHSA-xwg4-73v4-xw9w

FIXED npm-hono < 4.12.25 CVE-2026-54290 HIGH

npm-hono < 4.12.25 CODE_REPOSITORY/examples CVE-2026-54290 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/855

Related URLs

GHSA-88fw-hqm2-52qc

https://nvd.nist.gov/vuln/detail/CVE-2026-54290

GHSA-88fw-hqm2-52qc

FIXED npm-hono < 4.12.25 CVE-2026-54288 MEDIUM

npm-hono < 4.12.25 CODE_REPOSITORY/examples CVE-2026-54288 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/857

Related URLs

GHSA-rv63-4mwf-qqc2

https://nvd.nist.gov/vuln/detail/CVE-2026-54288

GHSA-rv63-4mwf-qqc2

FIXED npm-hono < 4.12.25 CVE-2026-54286 MEDIUM

npm-hono < 4.12.25 CODE_REPOSITORY/examples CVE-2026-54286 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/854

Related URLs

GHSA-wwfh-h76j-fc44

https://nvd.nist.gov/vuln/detail/CVE-2026-54286

GHSA-wwfh-h76j-fc44

FIXED npm-hono < 4.12.25 CVE-2026-54287 MEDIUM

npm-hono < 4.12.25 CODE_REPOSITORY/examples CVE-2026-54287 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/853

Related URLs

GHSA-j6c9-x7qj-28xf

https://nvd.nist.gov/vuln/detail/CVE-2026-54287

GHSA-j6c9-x7qj-28xf

FIXED npm-hono < 4.12.25 CVE-2026-54289 MEDIUM

npm-hono < 4.12.25 CODE_REPOSITORY/examples CVE-2026-54289 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/856

Related URLs

GHSA-wgpf-jwqj-8h8p

https://nvd.nist.gov/vuln/detail/CVE-2026-54289

GHSA-wgpf-jwqj-8h8p

FIXED npm-axios >= 0.19.0, < 0.31.1 CVE-2026-44495 HIGH

npm-axios >= 0.19.0, < 0.31.1 CODE_REPOSITORY/examples CVE-2026-44495 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/823

Related URLs

GHSA-3g43-6gmg-66jw

https://nvd.nist.gov/vuln/detail/CVE-2026-44495

GHSA-3g43-6gmg-66jw

FIXED npm-nanoid < 3.3.16 CVE-2026-67214 HIGH

npm-nanoid < 3.3.16 CODE_REPOSITORY/examples CVE-2026-67214 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1069

Related URLs

https://nvd.nist.gov/vuln/detail/CVE-2026-67214

ai/nanoid@6ccc67b

https://github.com/ai/nanoid/releases/tag/5.1.16

https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module

fix(non-secure): clamp a negative size instead of looping forever ai/nanoid#600

fix(non-secure): clamp negative size to prevent infinite loop ai/nanoid#601

ai/nanoid@e835c9b

GHSA-28wg-ghj8-5hjv

FIXED npm-nanoid < 3.3.18 CVE-2026-67213 HIGH

npm-nanoid < 3.3.18 CODE_REPOSITORY/examples CVE-2026-67213 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1076

Related URLs

https://nvd.nist.gov/vuln/detail/CVE-2026-67213

ai/nanoid@cb3626d

https://github.com/ai/nanoid/releases/tag/5.1.6

https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom

ai/nanoid@f9d13f1

https://github.com/ai/nanoid/releases/tag/3.3.17

ai/nanoid@e10f8d4

https://github.com/ai/nanoid/releases/tag/3.3.18

GHSA-2v37-7h3g-55p8

FIXED npm-brace-expansion >= 2.0.0, < 2.1.2 CVE-2026-13149 HIGH

npm-brace-expansion >= 2.0.0, < 2.1.2 CODE_REPOSITORY/examples CVE-2026-13149 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/888

Related URLs

GHSA-3jxr-9vmj-r5cp

https://nvd.nist.gov/vuln/detail/CVE-2026-13149

fix: v1 backport for CVE-2026-13149 juliangruber/brace-expansion#122

fix: v2 backport for CVE-2026-13149 juliangruber/brace-expansion#123

juliangruber/brace-expansion@835d6be

juliangruber/brace-expansion@c7e33ec

juliangruber/brace-expansion@d74e630

https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16

https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2

https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7

https://www.npmjs.com/package/brace-expansion

GHSA-3jxr-9vmj-r5cp

FIXED npm-brace-expansion < 1.1.16 CVE-2026-13149 HIGH

npm-brace-expansion < 1.1.16 CODE_REPOSITORY/examples CVE-2026-13149 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/959

Related URLs

GHSA-3jxr-9vmj-r5cp

https://nvd.nist.gov/vuln/detail/CVE-2026-13149

fix: v1 backport for CVE-2026-13149 juliangruber/brace-expansion#122

fix: v2 backport for CVE-2026-13149 juliangruber/brace-expansion#123

juliangruber/brace-expansion@835d6be

juliangruber/brace-expansion@c7e33ec

juliangruber/brace-expansion@d74e630

https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16

https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2

https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7

https://www.npmjs.com/package/brace-expansion

GHSA-3jxr-9vmj-r5cp

FIXED npm-axios < 0.30.0 CVE-2025-27152 HIGH

npm-axios < 0.30.0 CODE_REPOSITORY/examples CVE-2025-27152 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/150

Related URLs

GHSA-jr5f-v2jv-69x6

Server-Side Request Forgery Vulnerability (CVE-2024-39338) axios/axios#6463

axios/axios@fb8eec2

https://github.com/axios/axios/releases/tag/v1.8.2

https://nvd.nist.gov/vuln/detail/CVE-2025-27152

Backport allowAbsoluteUrls vuln fix to v0.x axios/axios#6829

axios/axios@02c3c69

GHSA-jr5f-v2jv-69x6

FIXED npm-minimatch >= 9.0.0, < 9.0.6 CVE-2026-26996 HIGH

npm-minimatch >= 9.0.0, < 9.0.6 CODE_REPOSITORY/examples CVE-2026-26996 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/415

Related URLs

GHSA-3ppc-4f35-3m26

isaacs/minimatch@2e111f3

https://nvd.nist.gov/vuln/detail/CVE-2026-26996

GHSA-3ppc-4f35-3m26

FIXED npm-rollup >= 4.0.0, < 4.59.0 CVE-2026-27606 HIGH

npm-rollup >= 4.0.0, < 4.59.0 CODE_REPOSITORY/examples CVE-2026-27606 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/421

Related URLs

GHSA-mw96-cpmx-2vgc

https://nvd.nist.gov/vuln/detail/CVE-2026-27606

rollup/rollup@c60770d

rollup/rollup@c8cf1f9

rollup/rollup@d6dee5e

https://github.com/rollup/rollup/releases/tag/v2.80.0

https://github.com/rollup/rollup/releases/tag/v3.30.0

https://github.com/rollup/rollup/releases/tag/v4.59.0

GHSA-mw96-cpmx-2vgc

FIXED npm-sharp < 0.35.0 GHSA-f88m-g3jw-g9cj HIGH

npm-sharp < 0.35.0 CODE_REPOSITORY/examples GHSA-f88m-g3jw-g9cj HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/938

Related URLs

GHSA-2fcj-gj27-279x

GHSA-523x-vhfw-6r76

GHSA-jmwm-wc68-mhwm

GHSA-r98w-4fp7-m9c7

GHSA-f88m-g3jw-g9cj

GHSA-f88m-g3jw-g9cj

FIXED npm-next >= 14.1.1, < 15.5.21 CVE-2026-64649 HIGH

npm-next >= 14.1.1, < 15.5.21 CODE_REPOSITORY/examples CVE-2026-64649 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1001

Related URLs

GHSA-89xv-2m56-2m9x

vercel/next.js@b512063

vercel/next.js@e3e5666

https://github.com/vercel/next.js/releases/tag/v15.5.21

https://github.com/vercel/next.js/releases/tag/v16.2.11

GHSA-89xv-2m56-2m9x

FIXED npm-react-router >= 7.0.0, < 7.18.0 CVE-2026-55685 HIGH

npm-react-router >= 7.0.0, < 7.18.0 CODE_REPOSITORY/examples CVE-2026-55685 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/957

Related URLs

GHSA-chx6-hx7r-mcp5

Optimize route matching internals remix-run/react-router#15186

remix-run/react-router@09e6020

https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180

https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0

GHSA-chx6-hx7r-mcp5

FIXED npm-next >= 13.0.0, < 15.5.21 CVE-2026-64641 HIGH

npm-next >= 13.0.0, < 15.5.21 CODE_REPOSITORY/examples CVE-2026-64641 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1021

Related URLs

GHSA-m99w-x7hq-7vfj

Improve performance of validating MPA form submissions vercel/next.js#96013

vercel/next.js@0196285

https://github.com/vercel/next.js/releases/tag/v15.5.21

https://github.com/vercel/next.js/releases/tag/v16.2.11

GHSA-m99w-x7hq-7vfj

FIXED npm-next >= 13.0.0, < 15.5.21 CVE-2026-64643 MEDIUM

npm-next >= 13.0.0, < 15.5.21 CODE_REPOSITORY/examples CVE-2026-64643 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/1019

Related URLs

GHSA-955p-x3mx-jcvp

vercel/next.js@1b0c3ae

vercel/next.js@ff12a61

https://github.com/vercel/next.js/releases/tag/v15.5.21

https://github.com/vercel/next.js/releases/tag/v16.2.11

GHSA-955p-x3mx-jcvp

FIXED npm-next >= 13.0.0, < 15.5.21 CVE-2026-64646 MEDIUM

npm-next >= 13.0.0, < 15.5.21 CODE_REPOSITORY/examples CVE-2026-64646 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/1023

Related URLs

GHSA-4c39-4ccg-62r3

vercel/next.js@57c31f7

vercel/next.js@9a4651e

https://github.com/vercel/next.js/releases/tag/v15.5.21

https://github.com/vercel/next.js/releases/tag/v16.2.11

GHSA-4c39-4ccg-62r3

FIXED npm-next >= 13.0.0, < 15.5.21 CVE-2026-64648 MEDIUM

npm-next >= 13.0.0, < 15.5.21 CODE_REPOSITORY/examples CVE-2026-64648 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/1017

Related URLs

GHSA-68g3-v927-f742

vercel/next.js@062f667

vercel/next.js@73b9487

https://github.com/vercel/next.js/releases/tag/v15.5.21

https://github.com/vercel/next.js/releases/tag/v16.2.11

GHSA-68g3-v927-f742

FIXED npm-next >= 13.0.0, < 15.5.21 CVE-2026-64647 MEDIUM

npm-next >= 13.0.0, < 15.5.21 CODE_REPOSITORY/examples CVE-2026-64647 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/1015

Related URLs

GHSA-4633-3j49-mh5q

fix(incremental-cache): byte-exact fetch cache key for binary bodies vercel/next.js#96008

vercel/next.js@025bf4a

https://github.com/vercel/next.js/releases/tag/v15.5.21

https://github.com/vercel/next.js/releases/tag/v16.2.11

GHSA-4633-3j49-mh5q

FIXED npm-next >= 12.0.0, < 15.5.21 CVE-2026-64645 HIGH

npm-next >= 12.0.0, < 15.5.21 CODE_REPOSITORY/examples CVE-2026-64645 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1027

Related URLs

GHSA-p9j2-gv94-2wf4

vercel/next.js@35f5013

vercel/next.js@d303326

https://github.com/vercel/next.js/releases/tag/v15.5.21

https://github.com/vercel/next.js/releases/tag/v16.2.11

GHSA-p9j2-gv94-2wf4

FIXED npm-react-router >= 7.12.0, < 7.18.2 GHSA-qwww-vcr4-c8h2 HIGH

npm-react-router >= 7.12.0, < 7.18.2 CODE_REPOSITORY/examples GHSA-qwww-vcr4-c8h2 HIGH remediate by: 2026-10-03T14:05:19.404Z

https://github.com/commercelayer/examples/security/dependabot/1052

Related URLs

GHSA-qwww-vcr4-c8h2

remix-run/react-router@7a71c72

https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830

https://github.com/remix-run/react-router/releases/tag/react-router@8.3.0

http://github.com/remix-run/react-router/pull/15311

Backport RSC CSRF hardening to v7 remix-run/react-router#15353

remix-run/react-router@8ebd5df

https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

https://github.com/remix-run/react-router/releases/tag/react-router%407.18.2

GHSA-qwww-vcr4-c8h2

FIXED npm-uuid < 11.1.1 CVE-2026-41907 MEDIUM

npm-uuid < 11.1.1 CODE_REPOSITORY/examples CVE-2026-41907 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/754

Related URLs

GHSA-w5hq-g745-h8pq

uuidjs/uuid@3d2c5b0

https://github.com/uuidjs/uuid/releases/tag/v14.0.0

https://nvd.nist.gov/vuln/detail/CVE-2026-41907

uuidjs/uuid@32389c8

uuidjs/uuid@3d61d6a

uuidjs/uuid@9d27ddf

https://github.com/uuidjs/uuid/releases/tag/v11.1.1

https://github.com/uuidjs/uuid/releases/tag/v12.0.1

https://github.com/uuidjs/uuid/releases/tag/v13.0.1

GHSA-w5hq-g745-h8pq

FIXED npm-react-router >= 7.11.0, < 7.18.0 CVE-2026-53667 MEDIUM

npm-react-router >= 7.11.0, < 7.18.0 CODE_REPOSITORY/examples CVE-2026-53667 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/949

Related URLs

GHSA-h8fp-f39c-q6mh

Validate RSC redirect protocols remix-run/react-router#15177

remix-run/react-router@ce596e8

https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180

https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0

GHSA-h8fp-f39c-q6mh

FIXED npm-axios >= 0.8.1, < 0.28.0 CVE-2023-45857 MEDIUM

npm-axios >= 0.8.1, < 0.28.0 CODE_REPOSITORY/examples CVE-2023-45857 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/54

Related URLs

https://nvd.nist.gov/vuln/detail/CVE-2023-45857

CVE-2023-45857 (CWE-359) XSRF-TOKEN value is disclosed to an unauthorised actor axios/axios#6006

CSRF vulnerability in AXIOS 0.24.1 to latest axios/axios#6022

CVE 2023 45857 axios/axios#6028

axios/axios@96ee232

https://github.com/axios/axios/releases/tag/v1.6.0

https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

fix: resolve CVE-2023-45857 in v0.x branch axios/axios#6091

axios/axios@2755df5

https://github.com/axios/axios/releases/tag/v0.28.0

https://security.netapp.com/advisory/ntap-20240621-0006

GHSA-wf5p-g6vw-rhxx

FIXED npm-follow-redirects <= 1.15.5 CVE-2024-28849 MEDIUM

npm-follow-redirects <= 1.15.5 CODE_REPOSITORY/examples CVE-2024-28849 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/62

Related URLs

GHSA-cxjh-pqwp-8mfp

follow-redirects/follow-redirects@c4f847f

https://fetch.spec.whatwg.org/#authentication-entries

https://nvd.nist.gov/vuln/detail/CVE-2024-28849

Redirect can expose netrc password psf/requests#1885

https://hackerone.com/reports/2390009

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z

GHSA-cxjh-pqwp-8mfp

FIXED npm-next >= 15.0.0-canary.0, < 15.4.7 CVE-2025-57822 MEDIUM

npm-next >= 15.0.0-canary.0, < 15.4.7 CODE_REPOSITORY/examples CVE-2025-57822 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/224

Related URLs

GHSA-4342-x723-ch2f

vercel/next.js@9c9aaed

https://vercel.com/changelog/cve-2025-57822

https://nvd.nist.gov/vuln/detail/CVE-2025-57822

GHSA-4342-x723-ch2f

FIXED npm-next >= 0.9.9, < 14.2.32 CVE-2025-57822 MEDIUM

npm-next >= 0.9.9, < 14.2.32 CODE_REPOSITORY/examples CVE-2025-57822 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/255

Related URLs

GHSA-4342-x723-ch2f

vercel/next.js@9c9aaed

https://vercel.com/changelog/cve-2025-57822

https://nvd.nist.gov/vuln/detail/CVE-2025-57822

GHSA-4342-x723-ch2f

FIXED npm-lodash >= 4.0.0, <= 4.17.22 CVE-2025-13465 MEDIUM

npm-lodash >= 4.0.0, <= 4.17.22 CODE_REPOSITORY/examples CVE-2025-13465 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/339

Related URLs

GHSA-xxjr-mmjv-4gpg

https://nvd.nist.gov/vuln/detail/CVE-2025-13465

lodash/lodash@edadd45

https://cert-portal.siemens.com/productcert/html/ssa-253495.html

GHSA-xxjr-mmjv-4gpg

FIXED npm-brace-expansion >= 2.0.0, < 2.0.3 CVE-2026-33750 MEDIUM

npm-brace-expansion >= 2.0.0, < 2.0.3 CODE_REPOSITORY/examples CVE-2026-33750 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/502

Related URLs

GHSA-f886-m6hf-6m8v

https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113

https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184

Update affected versions for GHSA-f886-m6hf-6m8v (Patches backported to v1, v2, v3) juliangruber/brace-expansion#98

Backport fix for GHSA-f886-m6hf-6m8v to v1 juliangruber/brace-expansion#95

Backport fix for GHSA-f886-m6hf-6m8v to v2 juliangruber/brace-expansion#96

Backport fix for GHSA-f886-m6hf-6m8v to v3 juliangruber/brace-expansion#97

juliangruber/brace-expansion@311ac0d

juliangruber/brace-expansion@7fd684f

juliangruber/brace-expansion@b9cacd9

https://nvd.nist.gov/vuln/detail/CVE-2026-33750

GHSA-f886-m6hf-6m8v

FIXED npm-lodash <= 4.17.23 CVE-2026-2950 MEDIUM

npm-lodash <= 4.17.23 CODE_REPOSITORY/examples CVE-2026-2950 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/522

Related URLs

GHSA-f23m-r3pf-42rh

GHSA-xxjr-mmjv-4gpg

https://nvd.nist.gov/vuln/detail/CVE-2026-2950

GHSA-f23m-r3pf-42rh

FIXED npm-brace-expansion < 1.1.13 CVE-2026-33750 MEDIUM

npm-brace-expansion < 1.1.13 CODE_REPOSITORY/examples CVE-2026-33750 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/770

Related URLs

GHSA-f886-m6hf-6m8v

https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113

https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184

Update affected versions for GHSA-f886-m6hf-6m8v (Patches backported to v1, v2, v3) juliangruber/brace-expansion#98

Backport fix for GHSA-f886-m6hf-6m8v to v1 juliangruber/brace-expansion#95

Backport fix for GHSA-f886-m6hf-6m8v to v2 juliangruber/brace-expansion#96

Backport fix for GHSA-f886-m6hf-6m8v to v3 juliangruber/brace-expansion#97

juliangruber/brace-expansion@311ac0d

juliangruber/brace-expansion@7fd684f

juliangruber/brace-expansion@b9cacd9

https://nvd.nist.gov/vuln/detail/CVE-2026-33750

GHSA-f886-m6hf-6m8v

FIXED npm-hono >= 4.11.8, < 4.12.27 CVE-2026-59896 MEDIUM

npm-hono >= 4.11.8, < 4.12.27 CODE_REPOSITORY/examples CVE-2026-59896 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/916

Related URLs

GHSA-hvrm-45r6-mjfj

https://nvd.nist.gov/vuln/detail/CVE-2026-59896

honojs/hono@fab3b13

https://github.com/honojs/hono/releases/tag/v4.12.27

GHSA-hvrm-45r6-mjfj

FIXED npm-@babel/helpers < 7.26.10 CVE-2025-27789 MEDIUM

npm-@babel/helpers < 7.26.10 CODE_REPOSITORY/examples CVE-2025-27789 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/94

Related URLs

GHSA-968p-4wvh-cqc8

Fix processing of replacement pattern with named capture groups babel/babel#17173

babel/babel@d5952e8

https://nvd.nist.gov/vuln/detail/CVE-2025-27789

GHSA-968p-4wvh-cqc8

FIXED npm-@babel/runtime-corejs3 < 7.26.10 CVE-2025-27789 MEDIUM

npm-@babel/runtime-corejs3 < 7.26.10 CODE_REPOSITORY/examples CVE-2025-27789 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/95

Related URLs

GHSA-968p-4wvh-cqc8

Fix processing of replacement pattern with named capture groups babel/babel#17173

babel/babel@d5952e8

https://nvd.nist.gov/vuln/detail/CVE-2025-27789

GHSA-968p-4wvh-cqc8

FIXED npm-@babel/runtime < 7.26.10 CVE-2025-27789 MEDIUM

npm-@babel/runtime < 7.26.10 CODE_REPOSITORY/examples CVE-2025-27789 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/144

Related URLs

GHSA-968p-4wvh-cqc8

Fix processing of replacement pattern with named capture groups babel/babel#17173

babel/babel@d5952e8

https://nvd.nist.gov/vuln/detail/CVE-2025-27789

GHSA-968p-4wvh-cqc8

FIXED npm-next >= 15.0.0, <= 15.4.4 CVE-2025-57752 MEDIUM

npm-next >= 15.0.0, <= 15.4.4 CODE_REPOSITORY/examples CVE-2025-57752 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/222

Related URLs

GHSA-g5qg-72qw-gw5v

fix(next/image): fix image-optimizer.ts headers vercel/next.js#82114

vercel/next.js@6b12c60

https://vercel.com/changelog/cve-2025-57752

https://nvd.nist.gov/vuln/detail/CVE-2025-57752

GHSA-g5qg-72qw-gw5v

FIXED npm-next >= 15.0.0, <= 15.4.4 CVE-2025-55173 MEDIUM

npm-next >= 15.0.0, <= 15.4.4 CODE_REPOSITORY/examples CVE-2025-55173 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/220

Related URLs

GHSA-xv57-4mr9-wg8v

vercel/next.js@6b12c60

http://vercel.com/changelog/cve-2025-55173

https://nvd.nist.gov/vuln/detail/CVE-2025-55173

https://vercel.com/changelog/cve-2025-55173

GHSA-xv57-4mr9-wg8v

FIXED npm-next >= 0.9.9, < 14.2.31 CVE-2025-57752 MEDIUM

npm-next >= 0.9.9, < 14.2.31 CODE_REPOSITORY/examples CVE-2025-57752 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/244

Related URLs

GHSA-g5qg-72qw-gw5v

fix(next/image): fix image-optimizer.ts headers vercel/next.js#82114

vercel/next.js@6b12c60

https://vercel.com/changelog/cve-2025-57752

https://nvd.nist.gov/vuln/detail/CVE-2025-57752

GHSA-g5qg-72qw-gw5v

FIXED npm-next >= 0.9.9, < 14.2.31 CVE-2025-55173 MEDIUM

npm-next >= 0.9.9, < 14.2.31 CODE_REPOSITORY/examples CVE-2025-55173 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/258

Related URLs

GHSA-xv57-4mr9-wg8v

vercel/next.js@6b12c60

http://vercel.com/changelog/cve-2025-55173

https://nvd.nist.gov/vuln/detail/CVE-2025-55173

https://vercel.com/changelog/cve-2025-55173

GHSA-xv57-4mr9-wg8v

FIXED npm-follow-redirects < 1.15.4 CVE-2023-26159 MEDIUM

npm-follow-redirects < 1.15.4 CODE_REPOSITORY/examples CVE-2023-26159 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/34

Related URLs

https://nvd.nist.gov/vuln/detail/CVE-2023-26159

[Security Report] hostname spoofing via url.parse in follow-redirects follow-redirects/follow-redirects#235

Fix bracketed hostnames follow-redirects/follow-redirects#236

https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137

follow-redirects/follow-redirects@7a6567e

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM

https://security.netapp.com/advisory/ntap-20241108-0002

GHSA-jchw-25xp-jwwc

FIXED npm-express < 4.19.2 CVE-2024-29041 MEDIUM

npm-express < 4.19.2 CODE_REPOSITORY/examples CVE-2024-29041 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/64

Related URLs

GHSA-rv95-896h-c2vc

if "\@" in url ，the redirect result doesn't match the host of the new URL() koajs/koa#1800

[deleted] expressjs/express#5539

expressjs/express@0867302

expressjs/express@0b74695

https://expressjs.com/en/4x/api.html#res.location

https://nvd.nist.gov/vuln/detail/CVE-2024-29041

GHSA-rv95-896h-c2vc

FIXED npm-postcss < 8.5.10 CVE-2026-41305 MEDIUM

npm-postcss < 8.5.10 CODE_REPOSITORY/examples CVE-2026-41305 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/764

Related URLs

GHSA-qx2v-qp2m-jg93

https://nvd.nist.gov/vuln/detail/CVE-2026-41305

https://github.com/postcss/postcss/releases/tag/8.5.10

GHSA-qx2v-qp2m-jg93

FIXED npm-hono >= 4.0.0, < 4.12.27 CVE-2026-59895 MEDIUM

npm-hono >= 4.0.0, < 4.12.27 CODE_REPOSITORY/examples CVE-2026-59895 MEDIUM remediate by: 2026-11-02T14:05:20.177Z

https://github.com/commercelayer/examples/security/dependabot/919

Related URLs

GHSA-w62v-xxxg-mg59

https://nvd.nist.gov/vuln/detail/CVE-2026-59895

honojs/hono@cd3f6f7

https://github.com/honojs/hono/releases/tag/v4.12.27

GHSA-w62v-xxxg-mg59

REPO TAG SKIPPED (no releases)

adf

bump

No vulnerability is detected anymore.

Navigation Menu

Repository navigation

[VANTA] [VULNERABILITY] <HIGH> CVE-2023-45857, CVE-2024-39338, CVE-2025-27152 and others, fix before 2026-10-03 #39

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[VANTA] [VULNERABILITY] <HIGH> CVE-2023-45857, CVE-2024-39338, CVE-2025-27152 and others, fix before 2026-10-03 #39

Description

Activity

marco-commercelayer commented on Sep 9, 2026

marco-commercelayer commented on Sep 10, 2026

commercelayer-ci commented on Sep 15, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions