Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

JCodesMore/ai-website-cloner-template

https://github.com/JCodesMore/ai-website-cloner-template · scanned 2026-07-23 19:49 UTC (1 month, 2 weeks ago)

145 raw signals (0 security + 145 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 2 weeks ago · v9 · 145 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
66.2
/100
Security checks
66
0 findings
System graph
66
80.0% cov · 145 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 43 Medium 86 Low 15 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 145 Crowd 0 Layer: Security 70 Quality 10 Hardware 1 Cicd 1 Dependencies 63
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 66.2/100 with 80.0% coverage. It contains 122 nodes across 1 cross-layer flows, written primarily in mixed languages. Engine surfaced 145 findings — concentrated in security (70), dependencies (63), quality (10). Risk profile is high: 0 critical, 43 high, 86 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 144 of 145 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 5.0.5 — package-lock.json
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-13676: fast-uri 3.1.0 — package-lock.json
fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, …
VulnCve 2026 13676
high System graph security Trivy conf 1.00 CVE-2026-16221: fast-uri 3.1.0 — package-lock.json
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ... Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL pa…
VulnCve 2026 16221
high System graph security Trivy conf 1.00 CVE-2026-44573: next 16.2.1 — package-lock.json
next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authoriza…
VulnCve 2026 44573
high System graph security Trivy conf 1.00 CVE-2026-44574: next 16.2.1 — package-lock.json
Next.js: Next.js: Authorization bypass via crafted query parameters Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected…
VulnCve 2026 44574
high System graph security Trivy conf 1.00 CVE-2026-44575: next 16.2.1 — package-lock.json
next.js: Next.js: Unauthorized access to protected content via middleware bypass Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauth…
VulnCve 2026 44575
high System graph security Trivy conf 1.00 CVE-2026-44578: next 16.2.1 — package-lock.json
Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request…
VulnCve 2026 44578
high System graph security Trivy conf 1.00 CVE-2026-44579: next 16.2.1 — package-lock.json
next.js: Next.js: Denial of Service via crafted POST requests to server actions Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection ex…
VulnCve 2026 44579
high System graph security Trivy conf 1.00 CVE-2026-45109: next 16.2.1 — package-lock.json
next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Tur…
VulnCve 2026 45109
high System graph security Trivy conf 1.00 CVE-2026-4926: path-to-regexp 8.3.0 — package-lock.json
path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, cau…
VulnCve 2026 4926
high System graph security Trivy conf 1.00 CVE-2026-54290: hono 4.12.9 — package-lock.json
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflec…
VulnCve 2026 54290
high System graph security Trivy conf 1.00 CVE-2026-59869: js-yaml 4.1.1 — package-lock.json
js-yaml: js-yaml: Denial of Service via crafted YAML documents js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where…
VulnCve 2026 59869
high System graph security Trivy conf 1.00 CVE-2026-6321: fast-uri 3.1.0 — package-lock.json
fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory r…
VulnCve 2026 6321
high System graph security Trivy conf 1.00 CVE-2026-6322: fast-uri 3.1.0 — package-lock.json
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a…
VulnCve 2026 6322
high System graph security Trivy conf 1.00 CVE-2026-64641: next 16.2.1 — package-lock.json
Next.js: Denial of Service in App Router using Server Actions ## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. ## Workarounds No workaround exis…
VulnCve 2026 64641
high System graph security Trivy conf 1.00 CVE-2026-64642: next 16.2.1 — package-lock.json
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale ## Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication. ## Wor…
VulnCve 2026 64642
high System graph security Trivy conf 1.00 CVE-2026-64645: next 16.2.1 — package-lock.json
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname ## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffi…
VulnCve 2026 64645
high System graph security Trivy conf 1.00 CVE-2026-64649: next 16.2.1 — package-lock.json
Next.js: Server-Side Request Forgery in Server Actions on custom servers ## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to contro…
VulnCve 2026 64649
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile.dev
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile.dev
Misconfig
high System graph security Trivy conf 1.00 GHSA-8h8q-6873-q5fj: next 16.2.1 — package-lock.json
Next.js Vulnerable to Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-…
VulnGhsa 8h8q 6873 q5fj
high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.34.5 — package-lock.json
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…
VulnGhsa f88m g3jw g9cj
high System graph security Trivy conf 1.00 GHSA-q4gf-8mx6-v5v3: next 16.2.1 — package-lock.json
Next.js has a Denial of Service with Server Components A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-238…
VulnGhsa q4gf 8mx6 v5v3
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp
OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via exponent…
package-lock.json ScaOsvGhsa 3jxr 9vmj r5cp
high System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 5.0.5: GHSA-3jxr-9vmj-r5cp
OSV.dev reports `brace-expansion` at version `5.0.5` (resolved in `package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: DoS via exponenti…
package-lock.json ScaOsvGhsa 3jxr 9vmj r5cp
high System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.0: GHSA-4c8g-83qw-93j6
OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `package-lock.json`) is affected by GHSA-4c8g-83qw-93j6 (aka CVE-2026-13676). Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. fast-uri vulnerable to host confusion via failed…
package-lock.json ScaOsvGhsa 4c8g 83qw 93j6
high System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.0: GHSA-q3j6-qgpj-74h6
OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `package-lock.json`) is affected by GHSA-q3j6-qgpj-74h6 (aka CVE-2026-6321). Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. fast-uri vulnerable to path traversal via percent…
package-lock.json ScaOsvGhsa q3j6 qgpj 74h6
high System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.0: GHSA-v2hh-gcrm-f6hx
OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `package-lock.json`) is affected by GHSA-v2hh-gcrm-f6hx (aka CVE-2026-16221). Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. fast-uri vulnerable to host confusion via litera…
package-lock.json ScaOsvGhsa v2hh gcrm f6hx
high System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-uri 3.1.0: GHSA-v39h-62p7-jpjc
OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `package-lock.json`) is affected by GHSA-v39h-62p7-jpjc (aka CVE-2026-6322). Note: `fast-uri` is a transitive dependency — pulled in by another package, not declared directly in a manifest. fast-uri vulnerable to host confusion via percent…
package-lock.json ScaOsvGhsa v39h 62p7 jpjc
high System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-88fw-hqm2-52qc
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-88fw-hqm2-52qc (aka CVE-2026-54290). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. hono: CORS Middleware reflects any Origin with credenti…
package-lock.json ScaOsvGhsa 88fw hqm2 52qc
high System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m
OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `package-lock.json`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869). Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. js-yaml: YAML merge-key chains can force quadratic…
package-lock.json ScaOsvGhsa 52cp r559 cp3m
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-267c-6grr-h53f
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-267c-6grr-h53f (aka CVE-2026-44575). Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes Aliases: CVE-2026-44575 Advisory: https://osv.dev/vulnerability/GHSA…
package.json ScaOsvGhsa 267c 6grr h53f
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-26hh-7cqf-hhc6
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-26hh-7cqf-hhc6 (aka CVE-2026-45109). Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up Aliases: CVE-2026-45109 Advisory: https:/…
package.json ScaOsvGhsa 26hh 7cqf hhc6
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-36qx-fr4f-26g5
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-36qx-fr4f-26g5 (aka CVE-2026-44573). Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n Aliases: CVE-2026-44573 Advisory: https://osv.dev/vulnerability/GHSA-36qx-fr4f-26g5…
package.json ScaOsvGhsa 36qx fr4f 26g5
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-492v-c6pp-mqqv
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-492v-c6pp-mqqv (aka CVE-2026-44574). Next.js has a Middleware / Proxy bypass through dynamic route parameter injection Aliases: CVE-2026-44574 Advisory: https://osv.dev/vulnerability/GHSA-492v-c6pp-mq…
package.json ScaOsvGhsa 492v c6pp mqqv
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-6gpp-xcg3-4w24
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-6gpp-xcg3-4w24 (aka CVE-2026-64642). Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale Aliases: CVE-2026-64642 Advisory: https://osv.dev/vulnerability/GHS…
package.json ScaOsvGhsa 6gpp xcg3 4w24
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-89xv-2m56-2m9x
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-89xv-2m56-2m9x (aka CVE-2026-64649). Next.js: Server-Side Request Forgery in Server Actions on custom servers Aliases: CVE-2026-64649 Advisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x Fix: u…
package.json ScaOsvGhsa 89xv 2m56 2m9x
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-8h8q-6873-q5fj
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-8h8q-6873-q5fj. Next.js Vulnerable to Denial of Service with Server Components Advisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj Fix: upgrade `next` past the affected range per the advisory.
package.json ScaOsvGhsa 8h8q 6873 q5fj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-c4j6-fc7j-m34r
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-c4j6-fc7j-m34r (aka CVE-2026-44578). Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades Aliases: CVE-2026-44578 Advisory: https://osv.dev/vulnerability/GHSA-c4j…
package.json ScaOsvGhsa c4j6 fc7j m34r
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-m99w-x7hq-7vfj
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-m99w-x7hq-7vfj (aka CVE-2026-64641). Next.js: Denial of Service in App Router using Server Actions Aliases: CVE-2026-64641 Advisory: https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj Fix: upgrade `nex…
package.json ScaOsvGhsa m99w x7hq 7vfj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-mg66-mrh9-m8jx
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-mg66-mrh9-m8jx (aka CVE-2026-44579). Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components Aliases: CVE-2026-44579 Advisory: https://osv.dev/vulnerab…
package.json ScaOsvGhsa mg66 mrh9 m8jx
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-p9j2-gv94-2wf4
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-p9j2-gv94-2wf4 (aka CVE-2026-64645). Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname Aliases: CVE-2026-64645 Advisory: https://osv.dev/vulnerability/GHSA-…
package.json ScaOsvGhsa p9j2 gv94 2wf4
high System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-q4gf-8mx6-v5v3
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-q4gf-8mx6-v5v3. Next.js has a Denial of Service with Server Components Advisory: https://osv.dev/vulnerability/GHSA-q4gf-8mx6-v5v3 Fix: upgrade `next` past the affected range per the advisory.
package.json ScaOsvGhsa q4gf 8mx6 v5v3
high System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q
OSV.dev reports `postcss` at version `8.4.31` (resolved in `package-lock.json`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623). Note: `postcss` is a transitive dependency — pulled in by another package, not declared directly in a manifest. PostCSS: Arbitrary file read and information disc…
package-lock.json ScaOsvGhsa 6g55 p6wh 862q
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/skills/clone-website/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/skills/clone-website/SKILL.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/skills/clone-website/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.codex/skills/clone-website/SKILL.md VerificationCodex instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .continue/commands/clone-website.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.continue/commands/clone-website.md VerificationAgent instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .cursor/commands/clone-website.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.cursor/commands/clone-website.md VerificationCursor rule
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .github/skills/clone-website/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.github/skills/clone-website/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .windsurf/workflows/clone-website.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.windsurf/workflows/clone-website.md VerificationAgent instruction
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Tests conf 1.00 CI is configured but no tests are detected
A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal.
CI/CDConfig theaterRepo hardening
medium System graph security Trivy conf 1.00 CVE-2026-39406: @hono/node-server 1.19.11 — package-lock.json
@hono/node-server: Middleware bypass via repeated slashes in serveStatic @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path.…
VulnCve 2026 39406
medium System graph security Trivy conf 1.00 CVE-2026-39407: hono 4.12.9 — package-lock.json
Hono: Middleware bypass via repeated slashes in serveStatic Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the reques…
VulnCve 2026 39407
medium System graph security Trivy conf 1.00 CVE-2026-39408: hono 4.12.9 — package-lock.json
Hono: Path traversal in toSSG() allows writing files outside the output directory Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during stat…
VulnCve 2026 39408
medium System graph security Trivy conf 1.00 CVE-2026-39409: hono 4.12.9 — package-lock.json
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying I…
VulnCve 2026 39409
medium System graph security Trivy conf 1.00 CVE-2026-39410: hono 4.12.9 — package-lock.json
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie() Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. C…
VulnCve 2026 39410
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.4.31 — package-lock.json
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.5.8 — package-lock.json
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-42338: ip-address 10.1.0 — package-lock.json
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embeddi…
VulnCve 2026 42338
medium System graph security Trivy conf 1.00 CVE-2026-44455: hono 4.12.9 — package-lock.json
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generat…
VulnCve 2026 44455
medium System graph security Trivy conf 1.00 CVE-2026-44456: hono 4.12.9 — package-lock.json
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunke…
VulnCve 2026 44456
medium System graph security Trivy conf 1.00 CVE-2026-44457: hono 4.12.9 — package-lock.json
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Var…
VulnCve 2026 44457
medium System graph security Trivy conf 1.00 CVE-2026-44458: hono 4.12.9 — package-lock.json
Hono has CSS Declaration Injection via Style Object Values in JSX SSR Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or …
VulnCve 2026 44458
medium System graph security Trivy conf 1.00 CVE-2026-44576: next 16.2.1 — package-lock.json
Next.js: Next.js: Cache poisoning vulnerability in React Server Components Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not corr…
VulnCve 2026 44576
medium System graph security Trivy conf 1.00 CVE-2026-44577: next 16.2.1 — package-lock.json
Next.js: Next.js: Denial of Service via Image Optimization API Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into mem…
VulnCve 2026 44577
medium System graph security Trivy conf 1.00 CVE-2026-44580: next 16.2.1 — package-lock.json
next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can b…
VulnCve 2026 44580
medium System graph security Trivy conf 1.00 CVE-2026-44581: next 16.2.1 — package-lock.json
next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scrip…
VulnCve 2026 44581
medium System graph security Trivy conf 1.00 CVE-2026-45149: brace-expansion 5.0.5 — package-lock.json
brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expa…
VulnCve 2026 45149
medium System graph security Trivy conf 1.00 CVE-2026-47673: hono 4.12.9 — package-lock.json
Hono: JWT middleware accepts any Authorization scheme, not only Bearer Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header va…
VulnCve 2026 47673
medium System graph security Trivy conf 1.00 CVE-2026-47674: hono 4.12.9 — package-lock.json
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules…
VulnCve 2026 47674
medium System graph security Trivy conf 1.00 CVE-2026-47675: hono 4.12.9 — package-lock.json
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corru…
VulnCve 2026 47675
medium System graph security Trivy conf 1.00 CVE-2026-47676: hono 4.12.9 — package-lock.json
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw U…
VulnCve 2026 47676
medium System graph security Trivy conf 1.00 CVE-2026-4923: path-to-regexp 8.3.0 — package-lock.json
path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second…
VulnCve 2026 4923
medium System graph security Trivy conf 1.00 CVE-2026-53550: js-yaml 4.1.1 — package-lock.json
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence.…
VulnCve 2026 53550
medium System graph security Trivy conf 1.00 CVE-2026-54286: hono 4.12.9 — package-lock.json
hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \, which the Windows path resolver tre…
VulnCve 2026 54286
medium System graph security Trivy conf 1.00 CVE-2026-54287: hono 4.12.9 — package-lock.json
hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice …
VulnCve 2026 54287
medium System graph security Trivy conf 1.00 CVE-2026-54288: hono 4.12.9 — package-lock.json
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within…
VulnCve 2026 54288
medium System graph security Trivy conf 1.00 CVE-2026-54289: hono 4.12.9 — package-lock.json
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as severa…
VulnCve 2026 54289
medium System graph security Trivy conf 1.00 CVE-2026-56761: hono 4.12.9 — package-lock.json
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attr…
VulnCve 2026 56761
medium System graph security Trivy conf 1.00 CVE-2026-59895: hono 4.12.9 — package-lock.json
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the …
VulnCve 2026 59895
medium System graph security Trivy conf 1.00 CVE-2026-59896: hono 4.12.9 — package-lock.json
hono/jsx does not isolate context per request, leading to cross-request data disclosure Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing creat…
VulnCve 2026 59896
medium System graph security Trivy conf 1.00 CVE-2026-59897: hono 4.12.9 — package-lock.json
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value bec…
VulnCve 2026 59897
medium System graph security Trivy conf 1.00 CVE-2026-64643: next 16.2.1 — package-lock.json
Next.js: Unauthenticated disclosure of internal Server Function endpoints ## Impact In Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action ID…
VulnCve 2026 64643
medium System graph security Trivy conf 1.00 CVE-2026-64644: next 16.2.1 — package-lock.json
Next.js: Denial of Service in the Image Optimization API using SVGs ### Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause …
VulnCve 2026 64644
medium System graph security Trivy conf 1.00 CVE-2026-64646: next 16.2.1 — package-lock.json
Next.js: Unbounded Server Action payload in Edge runtime ## Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime ## Workarounds If you cannot upgrade, ensure your hos…
VulnCve 2026 64646
medium System graph security Trivy conf 1.00 CVE-2026-64647: next 16.2.1 — package-lock.json
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **r…
VulnCve 2026 64647
medium System graph security Trivy conf 1.00 CVE-2026-64648: next 16.2.1 — package-lock.json
Next.js: Cache confusion of response bodies for requests with bodies ## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauth…
VulnCve 2026 64648
medium System graph security Trivy conf 1.00 CVE-2026-8723: qs 6.15.0 — package-lock.json
### Summary `qs.stringify` throws `TypeError` when called with `arr ... ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's nul…
VulnCve 2026 8723
medium System graph security Trivy conf 1.00 GHSA-26pp-8wgv-hjvm: hono 4.12.9 — package-lock.json
Hono missing validation of cookie name on write path in setCookie() ## Summary Cookie names are not validated on the write path when using `setCookie()`, `serialize()`, or `serializeSigned()` to generate Set-Cookie headers. While certain cookie attributes such as domain and path are validated, t…
VulnGhsa 26pp 8wgv hjvm
medium System graph security Trivy conf 1.00 GHSA-frvp-7c67-39w9: @hono/node-server 1.19.11 — package-lock.json
Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) The same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44). ### Summary On Wind…
VulnGhsa frvp 7c67 39w9
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.
auth
medium System graph quality Tests conf 1.00 Very low test-to-source ratio
0 test file(s) for 8 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.
Coverage
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @hono/node-server 1.19.11: GHSA-92pp-h63x-v22m
OSV.dev reports `@hono/node-server` at version `1.19.11` (resolved in `package-lock.json`) is affected by GHSA-92pp-h63x-v22m (aka CVE-2026-39406). Note: `@hono/node-server` is a transitive dependency — pulled in by another package, not declared directly in a manifest. @hono/node-server: Middlewar…
package-lock.json ScaOsvGhsa 92pp h63x v22m
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @hono/node-server 1.19.11: GHSA-frvp-7c67-39w9
OSV.dev reports `@hono/node-server` at version `1.19.11` (resolved in `package-lock.json`) is affected by GHSA-frvp-7c67-39w9. Note: `@hono/node-server` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Node.js Adapter for Hono: Path traversal in `serv…
package-lock.json ScaOsvGhsa frvp 7c67 39w9
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v
OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `package-lock.json`) is affected by GHSA-f886-m6hf-6m8v (aka CVE-2026-33750). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: Zero-step sequen…
package-lock.json ScaOsvGhsa f886 m6hf 6m8v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 5.0.5: GHSA-jxxr-4gwj-5jf2
OSV.dev reports `brace-expansion` at version `5.0.5` (resolved in `package-lock.json`) is affected by GHSA-jxxr-4gwj-5jf2 (aka CVE-2026-45149). Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. brace-expansion: Large numeric ran…
package-lock.json ScaOsvGhsa jxxr 4gwj 5jf2
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-26pp-8wgv-hjvm
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-26pp-8wgv-hjvm (aka CVE-2026-56762). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono missing validation of cookie name on write path in…
package-lock.json ScaOsvGhsa 26pp 8wgv hjvm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-2gcr-mfcq-wcc3
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-2gcr-mfcq-wcc3 (aka CVE-2026-47676). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono: app.mount() strips mount prefix using undecoded p…
package-lock.json ScaOsvGhsa 2gcr mfcq wcc3
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-3hrh-pfw6-9m5x
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-3hrh-pfw6-9m5x (aka CVE-2026-47675). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono: Cookie helper does not sanitize sameSite and prio…
package-lock.json ScaOsvGhsa 3hrh pfw6 9m5x
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-458j-xx4x-4375
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-458j-xx4x-4375 (aka CVE-2026-56761). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. hono Improperly Handles JSX Attribute Names Allows HTML…
package-lock.json ScaOsvGhsa 458j xx4x 4375
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-69xw-7hcm-h432
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-69xw-7hcm-h432 (aka CVE-2026-44455). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. hono/jsx has Unvalidated JSX Tag Names that May Allow H…
package-lock.json ScaOsvGhsa 69xw 7hcm h432
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-9vqf-7f2p-gf9v
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-9vqf-7f2p-gf9v (aka CVE-2026-44456). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono: bodyLimit() can be bypassed for chunked / unknown…
package-lock.json ScaOsvGhsa 9vqf 7f2p gf9v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-f577-qrjj-4474
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-f577-qrjj-4474 (aka CVE-2026-47673). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono: JWT middleware accepts any Authorization scheme, …
package-lock.json ScaOsvGhsa f577 qrjj 4474
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-hvrm-45r6-mjfj
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-hvrm-45r6-mjfj (aka CVE-2026-59896). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. hono/jsx does not isolate context per request, leading …
package-lock.json ScaOsvGhsa hvrm 45r6 mjfj
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-j6c9-x7qj-28xf
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-j6c9-x7qj-28xf (aka CVE-2026-54287). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. hono: AWS Lambda adapter merges multiple `Set-Cookie` h…
package-lock.json ScaOsvGhsa j6c9 x7qj 28xf
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-p77w-8qqv-26rm
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-p77w-8qqv-26rm (aka CVE-2026-44457). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono's Cache Middleware ignores Vary: Authorization / V…
package-lock.json ScaOsvGhsa p77w 8qqv 26rm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-qp7p-654g-cw7p
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-qp7p-654g-cw7p (aka CVE-2026-44458). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono has CSS Declaration Injection via Style Object Val…
package-lock.json ScaOsvGhsa qp7p 654g cw7p
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-r5rp-j6wh-rvv4
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-r5rp-j6wh-rvv4 (aka CVE-2026-39410). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono: Non-breaking space prefix bypass in cookie name h…
package-lock.json ScaOsvGhsa r5rp j6wh rvv4
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-rv63-4mwf-qqc2
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-rv63-4mwf-qqc2 (aka CVE-2026-54288). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. hono: Body Limit Middleware can be bypassed on AWS Lamb…
package-lock.json ScaOsvGhsa rv63 4mwf qqc2
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-w62v-xxxg-mg59
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-w62v-xxxg-mg59 (aka CVE-2026-59895). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono: Server-Side XSS via JSX Escaping Bypass in cx() U…
package-lock.json ScaOsvGhsa w62v xxxg mg59
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-wgpf-jwqj-8h8p
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-wgpf-jwqj-8h8p (aka CVE-2026-54289). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. hono: Lambda@Edge adapter keeps only the last value of …
package-lock.json ScaOsvGhsa wgpf jwqj 8h8p
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-wmmm-f939-6g9c
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-wmmm-f939-6g9c. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wmmm…
package-lock.json ScaOsvGhsa wmmm f939 6g9c
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-wwfh-h76j-fc44
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-wwfh-h76j-fc44 (aka CVE-2026-54286). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. hono: Path traversal in `serve-static` on Windows via e…
package-lock.json ScaOsvGhsa wwfh h76j fc44
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-xf4j-xp2r-rqqx
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-xf4j-xp2r-rqqx. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xf4j…
package-lock.json ScaOsvGhsa xf4j xp2r rqqx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-xgm2-5f3f-mvvc
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-xgm2-5f3f-mvvc (aka CVE-2026-59897). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono: API Gateway v1 adapter can drop a distinct repeat…
package-lock.json ScaOsvGhsa xgm2 5f3f mvvc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-xpcf-pg52-r92g
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-xpcf-pg52-r92g. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xpcf…
package-lock.json ScaOsvGhsa xpcf pg52 r92g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-xrhx-7g5j-rcj5
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-xrhx-7g5j-rcj5. Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xrhx…
package-lock.json ScaOsvGhsa xrhx 7g5j rcj5
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency ip-address 10.1.0: GHSA-v2v4-37r5-5v8g
OSV.dev reports `ip-address` at version `10.1.0` (resolved in `package-lock.json`) is affected by GHSA-v2v4-37r5-5v8g (aka CVE-2026-42338). Note: `ip-address` is a transitive dependency — pulled in by another package, not declared directly in a manifest. ip-address has XSS in Address6 HTML-emittin…
package-lock.json ScaOsvGhsa v2v4 37r5 5v8g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68
OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `package-lock.json`) is affected by GHSA-h67p-54hq-rp68 (aka CVE-2026-53550). Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. JS-YAML: Quadratic-complexity DoS in merge key han…
package-lock.json ScaOsvGhsa h67p 54hq rp68
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-4633-3j49-mh5q
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-4633-3j49-mh5q (aka CVE-2026-64647). Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences Aliases: CVE-2026-64647 Advisory: https://osv.dev/vuln…
package.json ScaOsvGhsa 4633 3j49 mh5q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-4c39-4ccg-62r3
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-4c39-4ccg-62r3 (aka CVE-2026-64646). Next.js: Unbounded Server Action payload in Edge runtime Aliases: CVE-2026-64646 Advisory: https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3 Fix: upgrade `next` pa…
package.json ScaOsvGhsa 4c39 4ccg 62r3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-68g3-v927-f742
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-68g3-v927-f742 (aka CVE-2026-64648). Next.js: Cache confusion of response bodies for requests with bodies Aliases: CVE-2026-64648 Advisory: https://osv.dev/vulnerability/GHSA-68g3-v927-f742 Fix: upgra…
package.json ScaOsvGhsa 68g3 v927 f742
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-955p-x3mx-jcvp
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-955p-x3mx-jcvp (aka CVE-2026-64643). Next.js: Unauthenticated disclosure of internal Server Function endpoints Aliases: CVE-2026-64643 Advisory: https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp Fix: …
package.json ScaOsvGhsa 955p x3mx jcvp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-ffhc-5mcf-pf4q
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-ffhc-5mcf-pf4q (aka CVE-2026-44581). Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces Aliases: CVE-2026-44581 Advisory: https://osv.dev/vulnerability/GHSA-ffhc-5m…
package.json ScaOsvGhsa ffhc 5mcf pf4q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-gx5p-jg67-6x7h
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-gx5p-jg67-6x7h (aka CVE-2026-44580). Next.js has cross-site scripting in beforeInteractive scripts with untrusted input Aliases: CVE-2026-44580 Advisory: https://osv.dev/vulnerability/GHSA-gx5p-jg67-6…
package.json ScaOsvGhsa gx5p jg67 6x7h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-h64f-5h5j-jqjh
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-h64f-5h5j-jqjh (aka CVE-2026-44577). Next.js has a Denial of Service in the Image Optimization API Aliases: CVE-2026-44577 Advisory: https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh Fix: upgrade `nex…
package.json ScaOsvGhsa h64f 5h5j jqjh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-q8wf-6r8g-63ch
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-q8wf-6r8g-63ch (aka CVE-2026-64644). Next.js: Denial of Service in the Image Optimization API using SVGs Aliases: CVE-2026-64644 Advisory: https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch Fix: upgrad…
package.json ScaOsvGhsa q8wf 6r8g 63ch
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-wfc6-r584-vfw7
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-wfc6-r584-vfw7 (aka CVE-2026-44576). Next.js vulnerable to cache poisoning in React Server Component responses Aliases: CVE-2026-44576 Advisory: https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7 Fix: …
package.json ScaOsvGhsa wfc6 r584 vfw7
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93
OSV.dev reports `postcss` at version `8.4.31` (resolved in `package-lock.json`) is affected by GHSA-qx2v-qp2m-jg93 (aka CVE-2026-41305). Note: `postcss` is a transitive dependency — pulled in by another package, not declared directly in a manifest. PostCSS has XSS via Unescaped </style> in its CSS…
package-lock.json ScaOsvGhsa qx2v qp2m jg93
low System graph security Trivy conf 1.00 CVE-2026-12590: body-parser 2.2.2 — package-lock.json
body-parser: body-parser: Denial of Service via invalid limit option Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body…
VulnCve 2026 12590
low System graph security Trivy conf 1.00 CVE-2026-44459: hono 4.12.9 — package-lock.json
Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-sp…
VulnCve 2026 44459
low System graph security Trivy conf 1.00 CVE-2026-44572: next 16.2.1 — package-lock.json
next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path ha…
VulnCve 2026 44572
low System graph security Trivy conf 1.00 CVE-2026-44582: next 16.2.1 — package-lock.json
Next.js: Next.js: Cache poisoning allows incorrect response delivery Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with…
VulnCve 2026 44582
low System graph security Trivy conf 1.00 CVE-2026-49356: @babel/core 7.29.0 — package-lock.json
@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted cod…
VulnCve 2026 49356
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:11 containersPinned dependencies
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile
Misconfig
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile.dev
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile.dev
Misconfig
low System graph cicd CI/CD security conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
.github/workflows/ci.yml:18 CI/CD securitySupply chainGithub actions
low System graph quality Agent instructions conf 1.00 Multiple root agent instruction files without precedence
The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies.
Governance
low System graph dependencies dependencies conf 0.90 Vulnerable dependency @babel/core 7.29.0: GHSA-4x5r-pxfx-6jf8
OSV.dev reports `@babel/core` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-4x5r-pxfx-6jf8 (aka CVE-2026-49356). Note: `@babel/core` is a transitive dependency — pulled in by another package, not declared directly in a manifest. @babel/core: Arbitrary File Read via sour…
package-lock.json ScaOsvGhsa 4x5r pxfx 6jf8
low System graph dependencies dependencies conf 0.90 Vulnerable dependency body-parser 2.2.2: GHSA-v422-hmwv-36x6
OSV.dev reports `body-parser` at version `2.2.2` (resolved in `package-lock.json`) is affected by GHSA-v422-hmwv-36x6 (aka CVE-2026-12590). Note: `body-parser` is a transitive dependency — pulled in by another package, not declared directly in a manifest. body-parser vulnerable to denial of servic…
package-lock.json ScaOsvGhsa v422 hmwv 36x6
low System graph dependencies dependencies conf 0.90 Vulnerable dependency hono 4.12.9: GHSA-hm8q-7f3q-5f36
OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-hm8q-7f3q-5f36 (aka CVE-2026-44459). Note: `hono` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Hono has improper validation of NumericDate claims (exp…
package-lock.json ScaOsvGhsa hm8q 7f3q 5f36
low System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-3g8h-86w9-wvmq
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-3g8h-86w9-wvmq (aka CVE-2026-44572). Next.js's Middleware / Proxy redirects can be cache-poisoned Aliases: CVE-2026-44572 Advisory: https://osv.dev/vulnerability/GHSA-3g8h-86w9-wvmq Fix: upgrade `next…
package.json ScaOsvGhsa 3g8h 86w9 wvmq
low System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.2.1: GHSA-vfv6-92ff-j949
OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-vfv6-92ff-j949 (aka CVE-2026-44582). Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting Aliases: CVE-2026-44582 Advisory: https://osv.dev/vulnerability/GHSA-v…
package.json ScaOsvGhsa vfv6 92ff j949
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/9606d7eb-8f7c-4188-ac78-22192fd8dfaf/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/9606d7eb-8f7c-4188-ac78-22192fd8dfaf/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.