{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-7046052fae8eef95", "name": "CVE-2026-49356: @babel/core 7.29.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-49356: @babel/core 7.29.0 \u2014 package-lock.json"}, "fullDescription": {"text": "@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment\n\nBabel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 an\n\nPackage: @babel/core\nInstalled: 7.29.0\nFixed in: 8.0.0-rc.6, 7.29.6\nSeverity: LOW\nFix: Upgrade @babel/core to 8.0.0-rc.6, 7.29.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f46d47d75627968", "name": "CVE-2026-39406: @hono/node-server 1.19.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-39406: @hono/node-server 1.19.11 \u2014 package-lock.json"}, "fullDescription": {"text": "@hono/node-server: Middleware bypass via repeated slashes in serveStatic\n\n@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.\n\nPackage: @hono/node-server\nInstalled: 1.19.11\nFixed in: 1.19.13\nSeverity: MEDIUM\nFix: Upgrade @hono/node-server to 1.19.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7cee8d9c15654d6c", "name": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.11 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.11 \u2014 package-lock.json"}, "fullDescription": {"text": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nThe same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t\n\nPackage: @hono/node-server\nInstalled: 1.19.11\nFixed in: 2.0.5\nSeverity: MEDIUM\nFix: Upgrade @hono/node-server to 2.0.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c11829f375e6d960", "name": "CVE-2026-12590: body-parser 2.2.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 package-lock.json"}, "fullDescription": {"text": "body-parser: body-parser: Denial of Service via invalid limit option\n\nImpact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars\n\nPackage: body-parser\nInstalled: 2.2.2\nFixed in: 1.20.6, 2.3.0\nSeverity: LOW\nFix: Upgrade body-parser to 1.20.6, 2.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e07be437dbcc0f2a", "name": "CVE-2026-13149: brace-expansion 5.0.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 5.0.5 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 5.0.5\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e7887776a363aba2", "name": "CVE-2026-45149: brace-expansion 5.0.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-45149: brace-expansion 5.0.5 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vul\n\nPackage: brace-expansion\nInstalled: 5.0.5\nFixed in: 5.0.6\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4adf6d36ffd584f8", "name": "CVE-2026-13676: fast-uri 3.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-13676: fast-uri 3.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization\n\nfast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 4.0.1, 3.1.3, 2.4.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 4.0.1, 3.1.3, 2.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bf5bc3c980b78418", "name": "CVE-2026-16221: fast-uri 3.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-16221: fast-uri 3.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x  ...\n\nImpact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 2.4.3, 3.1.4, 4.1.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.3, 3.1.4, 4.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-795a1c1a931b0551", "name": "CVE-2026-6321: fast-uri 3.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-6321: fast-uri 3.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies\n\nfast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Version\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 3.1.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 3.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf47d36fffbc9566", "name": "CVE-2026-6322: fast-uri 3.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-6322: fast-uri 3.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling\n\nfast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a differ\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 3.1.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 3.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9d4784c57e9a3c01", "name": "CVE-2026-54290: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54290: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.25\nSeverity: HIGH\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4bfbc444c81d9a5f", "name": "CVE-2026-39407: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-39407: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: Middleware bypass via repeated slashes in serveStatic\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in \n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4dc6ae110c7ce807", "name": "CVE-2026-39408: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-39408: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: Path traversal in toSSG() allows writing files outside the output directory\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1befe18cd45046a9", "name": "CVE-2026-39409: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-39409: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13cfe8490a5c2687", "name": "CVE-2026-39410: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-39410: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-501c2c810a6c83ef", "name": "CVE-2026-44455: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44455: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40866e2477f38f5a", "name": "CVE-2026-44456: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44456: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: bodyLimit() can be bypassed for chunked / unknown-length requests\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c771d51cb689334e", "name": "CVE-2026-44457: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44457: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c12896d884be4c5", "name": "CVE-2026-44458: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44458: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono has CSS Declaration Injection via Style Object Values in JSX SSR\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34460729fac6ca66", "name": "CVE-2026-47673: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-47673: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: JWT middleware accepts any Authorization scheme, not only Bearer\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value \u2014 regardless of the scheme name in the first position \u2014 proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1048f23dea6bab68", "name": "CVE-2026-47674: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-47674: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 \n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule \u2014 such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses \u2014 do not match the normalized rule entry, causing the \n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00ab56c5a02018f0", "name": "CVE-2026-47675: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-47675: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed \n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-949ffc225d98f655", "name": "CVE-2026-47676: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-47676: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8828c34a20dd240b", "name": "CVE-2026-54286: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54286: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa5757abe63ec317", "name": "CVE-2026-54287: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54287: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2934d14459a176de", "name": "CVE-2026-54288: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54288: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-10ecbbdcbe6dc14a", "name": "CVE-2026-54289: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54289: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a1719c8b248ca3b9", "name": "CVE-2026-56761: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-56761: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR\n\nhono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.14\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4587467d18b07b20", "name": "CVE-2026-59895: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59895: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3d4477ad28ff4f5", "name": "CVE-2026-59896: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59896: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "hono/jsx does not isolate context per request, leading to cross-request data disclosure\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b639475d32566393", "name": "CVE-2026-59897: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59897: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65a4380981942af8", "name": "GHSA-26pp-8wgv-hjvm: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-26pp-8wgv-hjvm: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono missing validation of cookie name on write path in setCookie()\n\n## Summary\n\nCookie names are not validated on the write path when using `setCookie()`, `serialize()`, or `serializeSigned()` to generate Set-Cookie headers.\n\nWhile certain cookie attributes such as domain and path are validated, the cookie name itself may contain invalid characters.\n\nThis results in inconsistent handling of cookie names between parsing (read path) and serialization (write path).\n\n## Details\n\nWhen applications use `setCookie()`, `serialize()`, or `serializeSigned()` with a user-c\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc7af42bdaf6a560", "name": "CVE-2026-44459: hono 4.12.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44459: hono 4.12.9 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() \u2014 typically when the application itself issues such tokens, or when the signing key is otherwise unde\n\nPackage: hono\nInstalled: 4.12.9\nFixed in: 4.12.18\nSeverity: LOW\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb6002efe0da8368", "name": "CVE-2026-42338: ip-address 10.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42338: ip-address 10.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input\n\nip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods,\n\nPackage: ip-address\nInstalled: 10.1.0\nFixed in: 10.1.1\nSeverity: MEDIUM\nFix: Upgrade ip-address to 10.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc0ccd78b70c150d", "name": "CVE-2026-59869: js-yaml 4.1.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 3.15.0, 4.3.0\nSeverity: HIGH\nFix: Upgrade js-yaml to 3.15.0, 4.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-316f7609b2d00795", "name": "CVE-2026-53550: js-yaml 4.1.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML merge keys\n\njs-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerabil\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 4.2.0, 3.15.0\nSeverity: MEDIUM\nFix: Upgrade js-yaml to 4.2.0, 3.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb3cbf66af61081b", "name": "CVE-2026-44573: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44573: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n\n\nNext.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intende\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-010ebdf8ed5de1b5", "name": "CVE-2026-44574: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44574: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Next.js: Authorization bypass via crafted query parameters\n\nNext.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 1\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-00d0237ea446701e", "name": "CVE-2026-44575: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44575: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Unauthorized access to protected content via middleware bypass\n\nNext.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f998cbeb603c3165", "name": "CVE-2026-44578: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44578: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests\n\nNext.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ddb4d38ccac39ed", "name": "CVE-2026-44579: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44579: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Denial of Service via crafted POST requests to server actions\n\nNext.js is a React framework for building full-stack web applications. From  to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are den\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a7f6dbf44019a7d2", "name": "CVE-2026-45109: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-45109: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Information disclosure via security fix bypass in middleware with Turbopack\n\nNext.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.18, 16.2.6\nSeverity: HIGH\nFix: Upgrade next to 15.5.18, 16.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a181e32f9369bee3", "name": "CVE-2026-64641: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-64641: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Denial of Service in App Router using Server Actions\n\n## Impact\n\nCrafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.\n\n## Workarounds\n\nNo workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06062fe385ea54d4", "name": "CVE-2026-64642: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-64642: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale\n\n## Impact\n\nCrafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass middleware/proxy based authentication.\n\n## Workarounds\n\nIf you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa983302f9389d1b", "name": "CVE-2026-64645: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-64645: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname\n\n## Impact\n\nA `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's\u00a0hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A `redirects()` rule configured this way is vulnerable to an Open Redirect.\n\nThis affects any destination that puts a dynamic segmen\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f7c349954074dffb", "name": "CVE-2026-64649: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-64649: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Server-Side Request Forgery in Server Actions on custom servers\n\n## Impact\n\nWhen a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.\n\nApplications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d76d50b8a7498977", "name": "GHSA-8h8q-6873-q5fj: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-8h8q-6873-q5fj: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js Vulnerable to Denial of Service with Server Components\n\nA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh). \n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of \n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc78bdad6388eb3a", "name": "GHSA-q4gf-8mx6-v5v3: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-q4gf-8mx6-v5v3: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js has a Denial of Service with Server Components\n\nA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg). You can read more about this advisory our [this changelog](https://vercel.com/changelog/summary-of-cve-2026-23869).\n\nA specially crafted HTTP request can be sent to any App Rout\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.15, 16.2.3\nSeverity: HIGH\nFix: Upgrade next to 15.5.15, 16.2.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-052ccfa30d0fa67d", "name": "CVE-2026-44576: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44576: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Next.js: Cache poisoning vulnerability in React Server Components\n\nNext.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdd665106a30b984", "name": "CVE-2026-44577: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44577: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Next.js: Denial of Service via Image Optimization API\n\nNext.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42991412c5e131c0", "name": "CVE-2026-44580: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44580: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content\n\nNext.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vu\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a310b994373f8d82", "name": "CVE-2026-44581: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44581: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses\n\nNext.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed i\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3a3e111e250d462", "name": "CVE-2026-64643: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-64643: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Unauthenticated disclosure of internal Server Function endpoints\n\n## Impact\n\nIn Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used.\n\nServer Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references).\n\nAffected users are applications using App Router + Server Actions.  \n\nBy itself, this disclosure is typically a recon/enumeration primi\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9b2124110f65d5e", "name": "CVE-2026-64644: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-64644: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Denial of Service in the Image Optimization API using SVGs\n\n### Impact\n\nWhen self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in  `/_next/image` endpoints.\n\n- If you are using `config.images.remotePatterns`, only the patterns in that array are impacted.\n- If you are using `config.images.unoptimized: true`, you are NOT impacted.\n- If you are using `config.images.loader: 'custom'`\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b281001edafe2ac6", "name": "CVE-2026-64646: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-64646: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Unbounded Server Action payload in Edge runtime\n\n## Impact\n\nRequests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime\n\n## Workarounds\n\nIf you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24069f301e27b0ba", "name": "CVE-2026-64647: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-64647: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences\n\n## Impact\n\nA server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.\n\nThis is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for `\uc083\uc083` and `\uc104\uc104` in the request body would share the same cache.\n\n##\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f37f158ddcb21286", "name": "CVE-2026-64648: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-64648: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Cache confusion of response bodies for requests with bodies\n\n## Impact\n\nA server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.\n\nThis only applies to `fetch` calls with a request that has a different init than the one passed to `fetch`.\nSafe: `fetch(new Request(init), init)`\nUnsafe: `fetch(new Request(init), aDifferentInit)`\n\n## Work\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86fdf6512dcaf6c9", "name": "CVE-2026-44572: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44572: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects\n\nNext.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable red\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: LOW\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f83afaf9ca5921cb", "name": "CVE-2026-44582: next 16.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44582: next 16.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Next.js: Next.js: Cache poisoning allows incorrect response delivery\n\nNext.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.\n\nPackage: next\nInstalled: 16.2.1\nFixed in: 15.5.16, 16.2.5\nSeverity: LOW\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5910492003881b8", "name": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions\n\nImpact:\n\nA bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.\n\nPatches:\n\nFixed in version 8.4.0.\n\nWorkarounds:\n\nLimit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.\n\nPackage: path-to-regexp\nInstalled: 8.3.0\nFixed in: 8.4.0\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 8.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d14a76dccc37cb3d", "name": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards\n\nImpact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a too\n\nPackage: path-to-regexp\nInstalled: 8.3.0\nFixed in: 8.4.0\nSeverity: MEDIUM\nFix: Upgrade path-to-regexp to 8.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a03a7023015b81a9", "name": "CVE-2026-41305: postcss 8.4.31 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-41305: postcss 8.4.31 \u2014 package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c3e2ded556feb8d", "name": "CVE-2026-41305: postcss 8.5.8 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-41305: postcss 8.5.8 \u2014 package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.5.8\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d4ea3d1c43f14203", "name": "CVE-2026-8723: qs 6.15.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-8723: qs 6.15.0 \u2014 package-lock.json"}, "fullDescription": {"text": "### Summary    `qs.stringify` throws `TypeError` when called with `arr ...\n\n### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti\n\nPackage: qs\nInstalled: 6.15.0\nFixed in: 6.15.2\nSeverity: MEDIUM\nFix: Upgrade qs to 6.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-696edaf1bfda3eab", "name": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 package-lock.json"}, "fullDescription": {"text": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\n### Impact\n\nA number of vulnerabilities, two rated as \"High\" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.\n\nThose processing untrusted input with versions of sharp prior to 0.35.0 are affected.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.\n\n#### Using a globally-installed libvips?\n\nP\n\nPackage: sharp\nInstalled: 0.34.5\nFixed in: 0.35.0\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c4041c454cda88e", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0dabf1aa3028515d", "name": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.dev", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.dev"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: Dockerfile.dev"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5fe1868c15227b48", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.dev", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.dev"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile.dev"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-014b01fe7c256e0c", "name": "Agent authority lacks a verifier contract: .windsurf/workflows/clone-website.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .windsurf/workflows/clone-website.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d34317262df6979c", "name": "Agent authority lacks a verifier contract: .continue/commands/clone-website.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .continue/commands/clone-website.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59a096892e4a68cb", "name": "Agent authority lacks a verifier contract: .claude/skills/clone-website/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/clone-website/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e8e18c8a8c9f611", "name": "Agent authority lacks a verifier contract: .codex/skills/clone-website/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/clone-website/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ff7672e17304c68", "name": "Agent authority lacks a verifier contract: .github/skills/clone-website/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .github/skills/clone-website/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-546b152b2aaf5b54", "name": "Agent authority lacks a verifier contract: .cursor/commands/clone-website.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/commands/clone-website.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan .claude/skills/clone-website --format s"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ea0769065ed41804", "name": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 8 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3efe9ea558ff477", "name": "Vulnerable dependency next 16.2.1: GHSA-267c-6grr-h53f", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-267c-6grr-h53f"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-267c-6grr-h53f (aka CVE-2026-44575).\n\nNext.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes\n\nAliases: CVE-2026-44575\nAdvisory: https://osv.dev/vulnerability/GHSA-267c-6grr-h53f\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4c56e152cb70c8d", "name": "Vulnerable dependency next 16.2.1: GHSA-26hh-7cqf-hhc6", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-26hh-7cqf-hhc6"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-26hh-7cqf-hhc6 (aka CVE-2026-45109).\n\nNext.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up\n\nAliases: CVE-2026-45109\nAdvisory: https://osv.dev/vulnerability/GHSA-26hh-7cqf-hhc6\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2e277cb7b746b78d", "name": "Vulnerable dependency next 16.2.1: GHSA-36qx-fr4f-26g5", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-36qx-fr4f-26g5"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-36qx-fr4f-26g5 (aka CVE-2026-44573).\n\nNext.js has a Middleware / Proxy bypass in Pages Router applications using i18n\n\nAliases: CVE-2026-44573\nAdvisory: https://osv.dev/vulnerability/GHSA-36qx-fr4f-26g5\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f966b4e1a91c1b8e", "name": "Vulnerable dependency next 16.2.1: GHSA-3g8h-86w9-wvmq", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-3g8h-86w9-wvmq"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-3g8h-86w9-wvmq (aka CVE-2026-44572).\n\nNext.js's Middleware / Proxy redirects can be cache-poisoned\n\nAliases: CVE-2026-44572\nAdvisory: https://osv.dev/vulnerability/GHSA-3g8h-86w9-wvmq\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3679842d77a6f115", "name": "Vulnerable dependency next 16.2.1: GHSA-4633-3j49-mh5q", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-4633-3j49-mh5q"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-4633-3j49-mh5q (aka CVE-2026-64647).\n\nNext.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences\n\nAliases: CVE-2026-64647\nAdvisory: https://osv.dev/vulnerability/GHSA-4633-3j49-mh5q\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8e6aff0bb2cb9d6", "name": "Vulnerable dependency next 16.2.1: GHSA-492v-c6pp-mqqv", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-492v-c6pp-mqqv"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-492v-c6pp-mqqv (aka CVE-2026-44574).\n\nNext.js has a Middleware / Proxy bypass through dynamic route parameter injection\n\nAliases: CVE-2026-44574\nAdvisory: https://osv.dev/vulnerability/GHSA-492v-c6pp-mqqv\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6a208c6d8f9d86a7", "name": "Vulnerable dependency next 16.2.1: GHSA-4c39-4ccg-62r3", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-4c39-4ccg-62r3"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-4c39-4ccg-62r3 (aka CVE-2026-64646).\n\nNext.js: Unbounded Server Action payload in Edge runtime\n\nAliases: CVE-2026-64646\nAdvisory: https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c1531eb0b1836e5", "name": "Vulnerable dependency next 16.2.1: GHSA-68g3-v927-f742", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-68g3-v927-f742"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-68g3-v927-f742 (aka CVE-2026-64648).\n\nNext.js: Cache confusion of response bodies for requests with bodies\n\nAliases: CVE-2026-64648\nAdvisory: https://osv.dev/vulnerability/GHSA-68g3-v927-f742\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6726a5af7d48326f", "name": "Vulnerable dependency next 16.2.1: GHSA-6gpp-xcg3-4w24", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-6gpp-xcg3-4w24"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-6gpp-xcg3-4w24 (aka CVE-2026-64642).\n\nNext.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale\n\nAliases: CVE-2026-64642\nAdvisory: https://osv.dev/vulnerability/GHSA-6gpp-xcg3-4w24\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-51ba25bde7aa19f8", "name": "Vulnerable dependency next 16.2.1: GHSA-89xv-2m56-2m9x", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-89xv-2m56-2m9x"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-89xv-2m56-2m9x (aka CVE-2026-64649).\n\nNext.js: Server-Side Request Forgery in Server Actions on custom servers\n\nAliases: CVE-2026-64649\nAdvisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c6e66d0e52a2f567", "name": "Vulnerable dependency next 16.2.1: GHSA-8h8q-6873-q5fj", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-8h8q-6873-q5fj"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-8h8q-6873-q5fj.\n\nNext.js Vulnerable to Denial of Service with Server Components\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d26f87ae3dc469b7", "name": "Vulnerable dependency next 16.2.1: GHSA-955p-x3mx-jcvp", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-955p-x3mx-jcvp"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-955p-x3mx-jcvp (aka CVE-2026-64643).\n\nNext.js: Unauthenticated disclosure of internal Server Function endpoints\n\nAliases: CVE-2026-64643\nAdvisory: https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64ff9e7779412c8f", "name": "Vulnerable dependency next 16.2.1: GHSA-c4j6-fc7j-m34r", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-c4j6-fc7j-m34r"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-c4j6-fc7j-m34r (aka CVE-2026-44578).\n\nNext.js vulnerable to server-side request forgery in applications using WebSocket upgrades\n\nAliases: CVE-2026-44578\nAdvisory: https://osv.dev/vulnerability/GHSA-c4j6-fc7j-m34r\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df134c07827dfe16", "name": "Vulnerable dependency next 16.2.1: GHSA-ffhc-5mcf-pf4q", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-ffhc-5mcf-pf4q"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-ffhc-5mcf-pf4q (aka CVE-2026-44581).\n\nNext.js vulnerable to cross-site scripting in App Router applications using CSP nonces\n\nAliases: CVE-2026-44581\nAdvisory: https://osv.dev/vulnerability/GHSA-ffhc-5mcf-pf4q\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ad8a1dffe9c28e9", "name": "Vulnerable dependency next 16.2.1: GHSA-gx5p-jg67-6x7h", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-gx5p-jg67-6x7h"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-gx5p-jg67-6x7h (aka CVE-2026-44580).\n\nNext.js has cross-site scripting in beforeInteractive scripts with untrusted input\n\nAliases: CVE-2026-44580\nAdvisory: https://osv.dev/vulnerability/GHSA-gx5p-jg67-6x7h\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39ba4159fe872aca", "name": "Vulnerable dependency next 16.2.1: GHSA-h64f-5h5j-jqjh", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-h64f-5h5j-jqjh"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-h64f-5h5j-jqjh (aka CVE-2026-44577).\n\nNext.js has a Denial of Service in the Image Optimization API\n\nAliases: CVE-2026-44577\nAdvisory: https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32360048f57dc6b9", "name": "Vulnerable dependency next 16.2.1: GHSA-m99w-x7hq-7vfj", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-m99w-x7hq-7vfj"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-m99w-x7hq-7vfj (aka CVE-2026-64641).\n\nNext.js: Denial of Service in App Router using Server Actions\n\nAliases: CVE-2026-64641\nAdvisory: https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-60531e174c6b1be4", "name": "Vulnerable dependency next 16.2.1: GHSA-mg66-mrh9-m8jx", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-mg66-mrh9-m8jx"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-mg66-mrh9-m8jx (aka CVE-2026-44579).\n\nNext.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components\n\nAliases: CVE-2026-44579\nAdvisory: https://osv.dev/vulnerability/GHSA-mg66-mrh9-m8jx\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-915dd9587b1e1d9c", "name": "Vulnerable dependency next 16.2.1: GHSA-p9j2-gv94-2wf4", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-p9j2-gv94-2wf4"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-p9j2-gv94-2wf4 (aka CVE-2026-64645).\n\nNext.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname\n\nAliases: CVE-2026-64645\nAdvisory: https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-002e38639f0459b6", "name": "Vulnerable dependency next 16.2.1: GHSA-q4gf-8mx6-v5v3", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-q4gf-8mx6-v5v3"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-q4gf-8mx6-v5v3.\n\nNext.js has a Denial of Service with Server Components\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q4gf-8mx6-v5v3\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d2a2169b8478a318", "name": "Vulnerable dependency next 16.2.1: GHSA-q8wf-6r8g-63ch", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-q8wf-6r8g-63ch"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-q8wf-6r8g-63ch (aka CVE-2026-64644).\n\nNext.js: Denial of Service in the Image Optimization API using SVGs\n\nAliases: CVE-2026-64644\nAdvisory: https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8a986c258d81e49", "name": "Vulnerable dependency next 16.2.1: GHSA-vfv6-92ff-j949", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-vfv6-92ff-j949"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-vfv6-92ff-j949 (aka CVE-2026-44582).\n\nNext.js vulnerable to cache poisoning via collisions in React Server Component cache-busting\n\nAliases: CVE-2026-44582\nAdvisory: https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca4c758a53de9f1d", "name": "Vulnerable dependency next 16.2.1: GHSA-wfc6-r584-vfw7", "shortDescription": {"text": "Vulnerable dependency next 16.2.1: GHSA-wfc6-r584-vfw7"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.1` (resolved in `package-lock.json`) is affected by GHSA-wfc6-r584-vfw7 (aka CVE-2026-44576).\n\nNext.js vulnerable to cache poisoning in React Server Component responses\n\nAliases: CVE-2026-44576\nAdvisory: https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f520d22202dc0d77", "name": "Vulnerable dependency @babel/core 7.29.0: GHSA-4x5r-pxfx-6jf8", "shortDescription": {"text": "Vulnerable dependency @babel/core 7.29.0: GHSA-4x5r-pxfx-6jf8"}, "fullDescription": {"text": "OSV.dev reports `@babel/core` at version `7.29.0` (resolved in `package-lock.json`) is affected by GHSA-4x5r-pxfx-6jf8 (aka CVE-2026-49356).\nNote: `@babel/core` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\n@babel/core: Arbitrary File Read via sourceMappingURL Comment\n\nAliases: CVE-2026-49356\nAdvisory: https://osv.dev/vulnerability/GHSA-4x5r-pxfx-6jf8\nFix: upgrade `@babel/core` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-d10b60772a4768e3", "name": "Vulnerable dependency @hono/node-server 1.19.11: GHSA-92pp-h63x-v22m", "shortDescription": {"text": "Vulnerable dependency @hono/node-server 1.19.11: GHSA-92pp-h63x-v22m"}, "fullDescription": {"text": "OSV.dev reports `@hono/node-server` at version `1.19.11` (resolved in `package-lock.json`) is affected by GHSA-92pp-h63x-v22m (aka CVE-2026-39406).\nNote: `@hono/node-server` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\n@hono/node-server: Middleware bypass via repeated slashes in serveStatic\n\nAliases: CVE-2026-39406\nAdvisory: https://osv.dev/vulnerability/GHSA-92pp-h63x-v22m\nFix: upgrade `@hono/node-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-06dda7175bea3f4d", "name": "Vulnerable dependency @hono/node-server 1.19.11: GHSA-frvp-7c67-39w9", "shortDescription": {"text": "Vulnerable dependency @hono/node-server 1.19.11: GHSA-frvp-7c67-39w9"}, "fullDescription": {"text": "OSV.dev reports `@hono/node-server` at version `1.19.11` (resolved in `package-lock.json`) is affected by GHSA-frvp-7c67-39w9.\nNote: `@hono/node-server` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNode.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nAdvisory: https://osv.dev/vulnerability/GHSA-frvp-7c67-39w9\nFix: upgrade `@hono/node-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-22d2031218abc77b", "name": "Vulnerable dependency brace-expansion 5.0.5: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.5: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.5` (resolved in `package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5e3d326009ced3b2", "name": "Vulnerable dependency brace-expansion 5.0.5: GHSA-jxxr-4gwj-5jf2", "shortDescription": {"text": "Vulnerable dependency brace-expansion 5.0.5: GHSA-jxxr-4gwj-5jf2"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `5.0.5` (resolved in `package-lock.json`) is affected by GHSA-jxxr-4gwj-5jf2 (aka CVE-2026-45149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: Large numeric range defeats documented `max` DoS protection\n\nAliases: CVE-2026-45149\nAdvisory: https://osv.dev/vulnerability/GHSA-jxxr-4gwj-5jf2\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e8d77ca63cdd2701", "name": "Vulnerable dependency body-parser 2.2.2: GHSA-v422-hmwv-36x6", "shortDescription": {"text": "Vulnerable dependency body-parser 2.2.2: GHSA-v422-hmwv-36x6"}, "fullDescription": {"text": "OSV.dev reports `body-parser` at version `2.2.2` (resolved in `package-lock.json`) is affected by GHSA-v422-hmwv-36x6 (aka CVE-2026-12590).\nNote: `body-parser` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbody-parser vulnerable to denial of service when invalid limit value silently disables size enforcement\n\nAliases: CVE-2026-12590\nAdvisory: https://osv.dev/vulnerability/GHSA-v422-hmwv-36x6\nFix: upgrade `body-parser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-e6e15b4938a45354", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-d0471d67ddb79c72", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `package-lock.json`) is affected by GHSA-f886-m6hf-6m8v (aka CVE-2026-33750).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: Zero-step sequence causes process hang and memory exhaustion\n\nAliases: CVE-2026-33750\nAdvisory: https://osv.dev/vulnerability/GHSA-f886-m6hf-6m8v\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e0bcc5916af91f27", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-4c8g-83qw-93j6", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-4c8g-83qw-93j6"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `package-lock.json`) is affected by GHSA-4c8g-83qw-93j6 (aka CVE-2026-13676).\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nfast-uri vulnerable to host confusion via failed IDN canonicalization\n\nAliases: CVE-2026-13676\nAdvisory: https://osv.dev/vulnerability/GHSA-4c8g-83qw-93j6\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-41060e7beb571855", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-q3j6-qgpj-74h6", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-q3j6-qgpj-74h6"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `package-lock.json`) is affected by GHSA-q3j6-qgpj-74h6 (aka CVE-2026-6321).\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nfast-uri vulnerable to path traversal via percent-encoded dot segments\n\nAliases: CVE-2026-6321\nAdvisory: https://osv.dev/vulnerability/GHSA-q3j6-qgpj-74h6\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-e668e6737d5d8a0d", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-v2hh-gcrm-f6hx", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v2hh-gcrm-f6hx"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `package-lock.json`) is affected by GHSA-v2hh-gcrm-f6hx (aka CVE-2026-16221).\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nfast-uri vulnerable to host confusion via literal backslash authority delimiter\n\nAliases: CVE-2026-16221\nAdvisory: https://osv.dev/vulnerability/GHSA-v2hh-gcrm-f6hx\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c15f421d52222fa8", "name": "Vulnerable dependency fast-uri 3.1.0: GHSA-v39h-62p7-jpjc", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v39h-62p7-jpjc"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.0` (resolved in `package-lock.json`) is affected by GHSA-v39h-62p7-jpjc (aka CVE-2026-6322).\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nfast-uri vulnerable to host confusion via percent-encoded authority delimiters\n\nAliases: CVE-2026-6322\nAdvisory: https://osv.dev/vulnerability/GHSA-v39h-62p7-jpjc\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-12fcd89ca280169c", "name": "Vulnerable dependency hono 4.12.9: GHSA-26pp-8wgv-hjvm", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-26pp-8wgv-hjvm"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-26pp-8wgv-hjvm (aka CVE-2026-56762).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono missing validation of cookie name on write path in setCookie()\n\nAliases: CVE-2026-56762\nAdvisory: https://osv.dev/vulnerability/GHSA-26pp-8wgv-hjvm\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-93060a617f44f59d", "name": "Vulnerable dependency hono 4.12.9: GHSA-2gcr-mfcq-wcc3", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-2gcr-mfcq-wcc3"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-2gcr-mfcq-wcc3 (aka CVE-2026-47676).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths\n\nAliases: CVE-2026-47676\nAdvisory: https://osv.dev/vulnerability/GHSA-2gcr-mfcq-wcc3\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-89899c3509d792fe", "name": "Vulnerable dependency hono 4.12.9: GHSA-3hrh-pfw6-9m5x", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-3hrh-pfw6-9m5x"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-3hrh-pfw6-9m5x (aka CVE-2026-47675).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection\n\nAliases: CVE-2026-47675\nAdvisory: https://osv.dev/vulnerability/GHSA-3hrh-pfw6-9m5x\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-0de7d1665f27f09d", "name": "Vulnerable dependency hono 4.12.9: GHSA-458j-xx4x-4375", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-458j-xx4x-4375"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-458j-xx4x-4375 (aka CVE-2026-56761).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nhono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR\n\nAliases: CVE-2026-56761\nAdvisory: https://osv.dev/vulnerability/GHSA-458j-xx4x-4375\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3fe797b7f322cbe5", "name": "Vulnerable dependency hono 4.12.9: GHSA-69xw-7hcm-h432", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-69xw-7hcm-h432"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-69xw-7hcm-h432 (aka CVE-2026-44455).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nhono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection\n\nAliases: CVE-2026-44455\nAdvisory: https://osv.dev/vulnerability/GHSA-69xw-7hcm-h432\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ffaa9e3ba95b1a5a", "name": "Vulnerable dependency hono 4.12.9: GHSA-88fw-hqm2-52qc", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-88fw-hqm2-52qc"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-88fw-hqm2-52qc (aka CVE-2026-54290).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nhono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard\n\nAliases: CVE-2026-54290\nAdvisory: https://osv.dev/vulnerability/GHSA-88fw-hqm2-52qc\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-feee81cbbd83b2af", "name": "Vulnerable dependency hono 4.12.9: GHSA-9vqf-7f2p-gf9v", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-9vqf-7f2p-gf9v"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-9vqf-7f2p-gf9v (aka CVE-2026-44456).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono: bodyLimit() can be bypassed for chunked / unknown-length requests\n\nAliases: CVE-2026-44456\nAdvisory: https://osv.dev/vulnerability/GHSA-9vqf-7f2p-gf9v\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ff232ec048d12413", "name": "Vulnerable dependency hono 4.12.9: GHSA-f577-qrjj-4474", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-f577-qrjj-4474"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-f577-qrjj-4474 (aka CVE-2026-47673).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono: JWT middleware accepts any Authorization scheme, not only Bearer\n\nAliases: CVE-2026-47673\nAdvisory: https://osv.dev/vulnerability/GHSA-f577-qrjj-4474\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7b635e507a20dbd8", "name": "Vulnerable dependency hono 4.12.9: GHSA-hm8q-7f3q-5f36", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-hm8q-7f3q-5f36"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-hm8q-7f3q-5f36 (aka CVE-2026-44459).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()\n\nAliases: CVE-2026-44459\nAdvisory: https://osv.dev/vulnerability/GHSA-hm8q-7f3q-5f36\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-218236c9dc62e92c", "name": "Vulnerable dependency hono 4.12.9: GHSA-hvrm-45r6-mjfj", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-hvrm-45r6-mjfj"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-hvrm-45r6-mjfj (aka CVE-2026-59896).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nhono/jsx does not isolate context per request, leading to cross-request data disclosure\n\nAliases: CVE-2026-59896\nAdvisory: https://osv.dev/vulnerability/GHSA-hvrm-45r6-mjfj\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-bb6800c2b2ab964d", "name": "Vulnerable dependency hono 4.12.9: GHSA-j6c9-x7qj-28xf", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-j6c9-x7qj-28xf"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-j6c9-x7qj-28xf (aka CVE-2026-54287).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nhono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice\n\nAliases: CVE-2026-54287\nAdvisory: https://osv.dev/vulnerability/GHSA-j6c9-x7qj-28xf\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8ee87c22b02b4162", "name": "Vulnerable dependency hono 4.12.9: GHSA-p77w-8qqv-26rm", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-p77w-8qqv-26rm"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-p77w-8qqv-26rm (aka CVE-2026-44457).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage\n\nAliases: CVE-2026-44457\nAdvisory: https://osv.dev/vulnerability/GHSA-p77w-8qqv-26rm\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2636aeec1d4a591e", "name": "Vulnerable dependency hono 4.12.9: GHSA-qp7p-654g-cw7p", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-qp7p-654g-cw7p"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-qp7p-654g-cw7p (aka CVE-2026-44458).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono has CSS Declaration Injection via Style Object Values in JSX SSR\n\nAliases: CVE-2026-44458\nAdvisory: https://osv.dev/vulnerability/GHSA-qp7p-654g-cw7p\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-81b0be2fd5945726", "name": "Vulnerable dependency hono 4.12.9: GHSA-r5rp-j6wh-rvv4", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-r5rp-j6wh-rvv4"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-r5rp-j6wh-rvv4 (aka CVE-2026-39410).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono: Non-breaking space prefix bypass in cookie name handling in getCookie()\n\nAliases: CVE-2026-39410\nAdvisory: https://osv.dev/vulnerability/GHSA-r5rp-j6wh-rvv4\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9cc7711b79177221", "name": "Vulnerable dependency hono 4.12.9: GHSA-rv63-4mwf-qqc2", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-rv63-4mwf-qqc2"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-rv63-4mwf-qqc2 (aka CVE-2026-54288).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nhono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`\n\nAliases: CVE-2026-54288\nAdvisory: https://osv.dev/vulnerability/GHSA-rv63-4mwf-qqc2\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-37f7b267508e776e", "name": "Vulnerable dependency hono 4.12.9: GHSA-w62v-xxxg-mg59", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-w62v-xxxg-mg59"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-w62v-xxxg-mg59 (aka CVE-2026-59895).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono: Server-Side XSS via JSX Escaping Bypass in cx() Utility\n\nAliases: CVE-2026-59895\nAdvisory: https://osv.dev/vulnerability/GHSA-w62v-xxxg-mg59\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b06c2991952f024a", "name": "Vulnerable dependency hono 4.12.9: GHSA-wgpf-jwqj-8h8p", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-wgpf-jwqj-8h8p"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-wgpf-jwqj-8h8p (aka CVE-2026-54289).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nhono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest\n\nAliases: CVE-2026-54289\nAdvisory: https://osv.dev/vulnerability/GHSA-wgpf-jwqj-8h8p\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-813a2abba6486159", "name": "Vulnerable dependency hono 4.12.9: GHSA-wmmm-f939-6g9c", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-wmmm-f939-6g9c"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-wmmm-f939-6g9c.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wmmm-f939-6g9c\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1712b388569689c5", "name": "Vulnerable dependency hono 4.12.9: GHSA-wwfh-h76j-fc44", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-wwfh-h76j-fc44"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-wwfh-h76j-fc44 (aka CVE-2026-54286).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nhono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nAliases: CVE-2026-54286\nAdvisory: https://osv.dev/vulnerability/GHSA-wwfh-h76j-fc44\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-25e501421a283a0f", "name": "Vulnerable dependency hono 4.12.9: GHSA-xf4j-xp2r-rqqx", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-xf4j-xp2r-rqqx"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-xf4j-xp2r-rqqx.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xf4j-xp2r-rqqx\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cb66fc69d0878c89", "name": "Vulnerable dependency hono 4.12.9: GHSA-xgm2-5f3f-mvvc", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-xgm2-5f3f-mvvc"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-xgm2-5f3f-mvvc (aka CVE-2026-59897).\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nHono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication\n\nAliases: CVE-2026-59897\nAdvisory: https://osv.dev/vulnerability/GHSA-xgm2-5f3f-mvvc\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f0006346997f8e1a", "name": "Vulnerable dependency hono 4.12.9: GHSA-xpcf-pg52-r92g", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-xpcf-pg52-r92g"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-xpcf-pg52-r92g.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xpcf-pg52-r92g\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ca9c720e6d5af73a", "name": "Vulnerable dependency hono 4.12.9: GHSA-xrhx-7g5j-rcj5", "shortDescription": {"text": "Vulnerable dependency hono 4.12.9: GHSA-xrhx-7g5j-rcj5"}, "fullDescription": {"text": "OSV.dev reports `hono` at version `4.12.9` (resolved in `package-lock.json`) is affected by GHSA-xrhx-7g5j-rcj5.\nNote: `hono` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xrhx-7g5j-rcj5\nFix: upgrade `hono` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-69081f374cca2aed", "name": "Vulnerable dependency ip-address 10.1.0: GHSA-v2v4-37r5-5v8g", "shortDescription": {"text": "Vulnerable dependency ip-address 10.1.0: GHSA-v2v4-37r5-5v8g"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.1.0` (resolved in `package-lock.json`) is affected by GHSA-v2v4-37r5-5v8g (aka CVE-2026-42338).\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nip-address has XSS in Address6 HTML-emitting methods\n\nAliases: CVE-2026-42338\nAdvisory: https://osv.dev/vulnerability/GHSA-v2v4-37r5-5v8g\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1b636a45bdf9c032", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `package-lock.json`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\njs-yaml: YAML merge-key chains can force quadratic CPU consumption\n\nAliases: CVE-2026-59869\nAdvisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-4d0a19b03f4897fd", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `package-lock.json`) is affected by GHSA-h67p-54hq-rp68 (aka CVE-2026-53550).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nJS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases\n\nAliases: CVE-2026-53550\nAdvisory: https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-94ccd7b7179f963e", "name": "Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.31` (resolved in `package-lock.json`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments\n\nAliases: CVE-2026-45623\nAdvisory: https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-e9b8f136e566cd89", "name": "Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.31` (resolved in `package-lock.json`) is affected by GHSA-qx2v-qp2m-jg93 (aka CVE-2026-41305).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS has XSS via Unescaped </style> in its CSS Stringify Output\n\nAliases: CVE-2026-41305\nAdvisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30784"}, "properties": {"repository": "JCodesMore/ai-website-cloner-template", "repoUrl": "https://github.com/JCodesMore/ai-website-cloner-template", "branch": "main"}, "results": [{"ruleId": "scanner-7046052fae8eef95", "level": "note", "message": {"text": "CVE-2026-49356: @babel/core 7.29.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "f0044394f1c2ac17", "scanner": "scanner-primary", "fingerprint": "7046052fae8eef95", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49356"]}}, {"ruleId": "scanner-7f46d47d75627968", "level": "warning", "message": {"text": "CVE-2026-39406: @hono/node-server 1.19.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "15631b177ca64f6e", "scanner": "scanner-primary", "fingerprint": "7f46d47d75627968", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39406"]}}, {"ruleId": "scanner-7cee8d9c15654d6c", "level": "warning", "message": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "30050d81e6c53f93", "scanner": "scanner-primary", "fingerprint": "7cee8d9c15654d6c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-frvp-7c67-39w9"]}}, {"ruleId": "scanner-c11829f375e6d960", "level": "note", "message": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "2cc3cf9d6ecedcda", "scanner": "scanner-primary", "fingerprint": "c11829f375e6d960", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12590"]}}, {"ruleId": "scanner-e07be437dbcc0f2a", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 5.0.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "8775b18ee2ab6ac7", "scanner": "scanner-primary", "fingerprint": "e07be437dbcc0f2a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-e7887776a363aba2", "level": "warning", "message": {"text": "CVE-2026-45149: brace-expansion 5.0.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "4dea5563c24fccf6", "scanner": "scanner-primary", "fingerprint": "e7887776a363aba2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45149"]}}, {"ruleId": "scanner-4adf6d36ffd584f8", "level": "error", "message": {"text": "CVE-2026-13676: fast-uri 3.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "85801951583e7517", "scanner": "scanner-primary", "fingerprint": "4adf6d36ffd584f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13676"]}}, {"ruleId": "scanner-bf5bc3c980b78418", "level": "error", "message": {"text": "CVE-2026-16221: fast-uri 3.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "be42e91421de6101", "scanner": "scanner-primary", "fingerprint": "bf5bc3c980b78418", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16221"]}}, {"ruleId": "scanner-795a1c1a931b0551", "level": "error", "message": {"text": "CVE-2026-6321: fast-uri 3.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "05993e7b18c5a816", "scanner": "scanner-primary", "fingerprint": "795a1c1a931b0551", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6321"]}}, {"ruleId": "scanner-cf47d36fffbc9566", "level": "error", "message": {"text": "CVE-2026-6322: fast-uri 3.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "df4c97c1003072e7", "scanner": "scanner-primary", "fingerprint": "cf47d36fffbc9566", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6322"]}}, {"ruleId": "scanner-9d4784c57e9a3c01", "level": "error", "message": {"text": "CVE-2026-54290: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "ec2d5ea0e28fc031", "scanner": "scanner-primary", "fingerprint": "9d4784c57e9a3c01", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54290"]}}, {"ruleId": "scanner-4bfbc444c81d9a5f", "level": "warning", "message": {"text": "CVE-2026-39407: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "2c3e0f2a82a319aa", "scanner": "scanner-primary", "fingerprint": "4bfbc444c81d9a5f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39407"]}}, {"ruleId": "scanner-4dc6ae110c7ce807", "level": "warning", "message": {"text": "CVE-2026-39408: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "e2d1874c64fd375e", "scanner": "scanner-primary", "fingerprint": "4dc6ae110c7ce807", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39408"]}}, {"ruleId": "scanner-1befe18cd45046a9", "level": "warning", "message": {"text": "CVE-2026-39409: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "e3674bab07da4128", "scanner": "scanner-primary", "fingerprint": "1befe18cd45046a9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39409"]}}, {"ruleId": "scanner-13cfe8490a5c2687", "level": "warning", "message": {"text": "CVE-2026-39410: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "4510fe67f9df6104", "scanner": "scanner-primary", "fingerprint": "13cfe8490a5c2687", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39410"]}}, {"ruleId": "scanner-501c2c810a6c83ef", "level": "warning", "message": {"text": "CVE-2026-44455: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "a0434fd9eb6df127", "scanner": "scanner-primary", "fingerprint": "501c2c810a6c83ef", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44455"]}}, {"ruleId": "scanner-40866e2477f38f5a", "level": "warning", "message": {"text": "CVE-2026-44456: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "99f63af0fd68ded8", "scanner": "scanner-primary", "fingerprint": "40866e2477f38f5a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44456"]}}, {"ruleId": "scanner-c771d51cb689334e", "level": "warning", "message": {"text": "CVE-2026-44457: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "1d7df349c286f88a", "scanner": "scanner-primary", "fingerprint": "c771d51cb689334e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44457"]}}, {"ruleId": "scanner-4c12896d884be4c5", "level": "warning", "message": {"text": "CVE-2026-44458: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "dd4e838af3242534", "scanner": "scanner-primary", "fingerprint": "4c12896d884be4c5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44458"]}}, {"ruleId": "scanner-34460729fac6ca66", "level": "warning", "message": {"text": "CVE-2026-47673: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "10a375b6a914c371", "scanner": "scanner-primary", "fingerprint": "34460729fac6ca66", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47673"]}}, {"ruleId": "scanner-1048f23dea6bab68", "level": "warning", "message": {"text": "CVE-2026-47674: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "aa623861bbcb7147", "scanner": "scanner-primary", "fingerprint": "1048f23dea6bab68", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47674"]}}, {"ruleId": "scanner-00ab56c5a02018f0", "level": "warning", "message": {"text": "CVE-2026-47675: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "2a0547344de18aba", "scanner": "scanner-primary", "fingerprint": "00ab56c5a02018f0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47675"]}}, {"ruleId": "scanner-949ffc225d98f655", "level": "warning", "message": {"text": "CVE-2026-47676: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "eb5ff93ce288d783", "scanner": "scanner-primary", "fingerprint": "949ffc225d98f655", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47676"]}}, {"ruleId": "scanner-8828c34a20dd240b", "level": "warning", "message": {"text": "CVE-2026-54286: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "a4124107c3210c1e", "scanner": "scanner-primary", "fingerprint": "8828c34a20dd240b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54286"]}}, {"ruleId": "scanner-fa5757abe63ec317", "level": "warning", "message": {"text": "CVE-2026-54287: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "2e0885b613424708", "scanner": "scanner-primary", "fingerprint": "fa5757abe63ec317", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54287"]}}, {"ruleId": "scanner-2934d14459a176de", "level": "warning", "message": {"text": "CVE-2026-54288: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "089bf5d2ed227e7c", "scanner": "scanner-primary", "fingerprint": "2934d14459a176de", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54288"]}}, {"ruleId": "scanner-10ecbbdcbe6dc14a", "level": "warning", "message": {"text": "CVE-2026-54289: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "513e53ec1acf658f", "scanner": "scanner-primary", "fingerprint": "10ecbbdcbe6dc14a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54289"]}}, {"ruleId": "scanner-a1719c8b248ca3b9", "level": "warning", "message": {"text": "CVE-2026-56761: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "95ab76607e0f7111", "scanner": "scanner-primary", "fingerprint": "a1719c8b248ca3b9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56761"]}}, {"ruleId": "scanner-4587467d18b07b20", "level": "warning", "message": {"text": "CVE-2026-59895: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "451d29929a7eac68", "scanner": "scanner-primary", "fingerprint": "4587467d18b07b20", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59895"]}}, {"ruleId": "scanner-c3d4477ad28ff4f5", "level": "warning", "message": {"text": "CVE-2026-59896: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "e45d86110f57f598", "scanner": "scanner-primary", "fingerprint": "c3d4477ad28ff4f5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59896"]}}, {"ruleId": "scanner-b639475d32566393", "level": "warning", "message": {"text": "CVE-2026-59897: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "1c3b13e09e8f8a56", "scanner": "scanner-primary", "fingerprint": "b639475d32566393", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59897"]}}, {"ruleId": "scanner-65a4380981942af8", "level": "warning", "message": {"text": "GHSA-26pp-8wgv-hjvm: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "905df0a799b74504", "scanner": "scanner-primary", "fingerprint": "65a4380981942af8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-26pp-8wgv-hjvm"]}}, {"ruleId": "scanner-bc7af42bdaf6a560", "level": "note", "message": {"text": "CVE-2026-44459: hono 4.12.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "d25b58e1bb28d46c", "scanner": "scanner-primary", "fingerprint": "bc7af42bdaf6a560", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44459"]}}, {"ruleId": "scanner-bb6002efe0da8368", "level": "warning", "message": {"text": "CVE-2026-42338: ip-address 10.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "85dea9d0977e2b95", "scanner": "scanner-primary", "fingerprint": "bb6002efe0da8368", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42338"]}}, {"ruleId": "scanner-bc0ccd78b70c150d", "level": "error", "message": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "a4d9df15b5ac9116", "scanner": "scanner-primary", "fingerprint": "bc0ccd78b70c150d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59869"]}}, {"ruleId": "scanner-316f7609b2d00795", "level": "warning", "message": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "1e461c70b5f472cf", "scanner": "scanner-primary", "fingerprint": "316f7609b2d00795", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53550"]}}, {"ruleId": "scanner-fb3cbf66af61081b", "level": "error", "message": {"text": "CVE-2026-44573: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "2a937a1a71675555", "scanner": "scanner-primary", "fingerprint": "fb3cbf66af61081b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44573"]}}, {"ruleId": "scanner-010ebdf8ed5de1b5", "level": "error", "message": {"text": "CVE-2026-44574: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "bb4b3a31ea9b88cf", "scanner": "scanner-primary", "fingerprint": "010ebdf8ed5de1b5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44574"]}}, {"ruleId": "scanner-00d0237ea446701e", "level": "error", "message": {"text": "CVE-2026-44575: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "352e2624a2d677ae", "scanner": "scanner-primary", "fingerprint": "00d0237ea446701e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44575"]}}, {"ruleId": "scanner-f998cbeb603c3165", "level": "error", "message": {"text": "CVE-2026-44578: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "08e4e98b44965a5c", "scanner": "scanner-primary", "fingerprint": "f998cbeb603c3165", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44578"]}}, {"ruleId": "scanner-7ddb4d38ccac39ed", "level": "error", "message": {"text": "CVE-2026-44579: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "1c557a4ef8e897f8", "scanner": "scanner-primary", "fingerprint": "7ddb4d38ccac39ed", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44579"]}}, {"ruleId": "scanner-a7f6dbf44019a7d2", "level": "error", "message": {"text": "CVE-2026-45109: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "b5e799a1c0cf3140", "scanner": "scanner-primary", "fingerprint": "a7f6dbf44019a7d2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45109"]}}, {"ruleId": "scanner-a181e32f9369bee3", "level": "error", "message": {"text": "CVE-2026-64641: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "29a41f937d601da7", "scanner": "scanner-primary", "fingerprint": "a181e32f9369bee3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64641"]}}, {"ruleId": "scanner-06062fe385ea54d4", "level": "error", "message": {"text": "CVE-2026-64642: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "b564d25f3e29d7cb", "scanner": "scanner-primary", "fingerprint": "06062fe385ea54d4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64642"]}}, {"ruleId": "scanner-fa983302f9389d1b", "level": "error", "message": {"text": "CVE-2026-64645: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "c4bc0f12b3260df8", "scanner": "scanner-primary", "fingerprint": "fa983302f9389d1b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64645"]}}, {"ruleId": "scanner-f7c349954074dffb", "level": "error", "message": {"text": "CVE-2026-64649: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "92ef7b09dead9bb3", "scanner": "scanner-primary", "fingerprint": "f7c349954074dffb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64649"]}}, {"ruleId": "scanner-d76d50b8a7498977", "level": "error", "message": {"text": "GHSA-8h8q-6873-q5fj: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "618683f84ceecf76", "scanner": "scanner-primary", "fingerprint": "d76d50b8a7498977", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-8h8q-6873-q5fj"]}}, {"ruleId": "scanner-fc78bdad6388eb3a", "level": "error", "message": {"text": "GHSA-q4gf-8mx6-v5v3: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "ab61f823ddbc4edf", "scanner": "scanner-primary", "fingerprint": "fc78bdad6388eb3a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-q4gf-8mx6-v5v3"]}}, {"ruleId": "scanner-052ccfa30d0fa67d", "level": "warning", "message": {"text": "CVE-2026-44576: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "e5c69efd05b19643", "scanner": "scanner-primary", "fingerprint": "052ccfa30d0fa67d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44576"]}}, {"ruleId": "scanner-fdd665106a30b984", "level": "warning", "message": {"text": "CVE-2026-44577: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "bacea9ad6c1da1cd", "scanner": "scanner-primary", "fingerprint": "fdd665106a30b984", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44577"]}}, {"ruleId": "scanner-42991412c5e131c0", "level": "warning", "message": {"text": "CVE-2026-44580: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "c942abe9919fe6f3", "scanner": "scanner-primary", "fingerprint": "42991412c5e131c0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44580"]}}, {"ruleId": "scanner-a310b994373f8d82", "level": "warning", "message": {"text": "CVE-2026-44581: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "7991282ac6d7aac3", "scanner": "scanner-primary", "fingerprint": "a310b994373f8d82", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44581"]}}, {"ruleId": "scanner-c3a3e111e250d462", "level": "warning", "message": {"text": "CVE-2026-64643: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "6c3f9b89a0cd4b01", "scanner": "scanner-primary", "fingerprint": "c3a3e111e250d462", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64643"]}}, {"ruleId": "scanner-d9b2124110f65d5e", "level": "warning", "message": {"text": "CVE-2026-64644: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "1e7ab9c3e63e6232", "scanner": "scanner-primary", "fingerprint": "d9b2124110f65d5e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64644"]}}, {"ruleId": "scanner-b281001edafe2ac6", "level": "warning", "message": {"text": "CVE-2026-64646: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "dd8f4971b9f14555", "scanner": "scanner-primary", "fingerprint": "b281001edafe2ac6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64646"]}}, {"ruleId": "scanner-24069f301e27b0ba", "level": "warning", "message": {"text": "CVE-2026-64647: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "0744c38f1c7ae818", "scanner": "scanner-primary", "fingerprint": "24069f301e27b0ba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64647"]}}, {"ruleId": "scanner-f37f158ddcb21286", "level": "warning", "message": {"text": "CVE-2026-64648: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "eb38aafed50013b0", "scanner": "scanner-primary", "fingerprint": "f37f158ddcb21286", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64648"]}}, {"ruleId": "scanner-86fdf6512dcaf6c9", "level": "note", "message": {"text": "CVE-2026-44572: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "b0e67acd66f510e8", "scanner": "scanner-primary", "fingerprint": "86fdf6512dcaf6c9", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44572"]}}, {"ruleId": "scanner-f83afaf9ca5921cb", "level": "note", "message": {"text": "CVE-2026-44582: next 16.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "47217336742a7023", "scanner": "scanner-primary", "fingerprint": "f83afaf9ca5921cb", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44582"]}}, {"ruleId": "scanner-c5910492003881b8", "level": "error", "message": {"text": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "95dd5b04dfae0f2c", "scanner": "scanner-primary", "fingerprint": "c5910492003881b8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4926"]}}, {"ruleId": "scanner-d14a76dccc37cb3d", "level": "warning", "message": {"text": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "a6ce367a3efeafe9", "scanner": "scanner-primary", "fingerprint": "d14a76dccc37cb3d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4923"]}}, {"ruleId": "scanner-a03a7023015b81a9", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.4.31 \u2014 package-lock.json"}, "properties": {"repobilityId": "10b93266de05d9b1", "scanner": "scanner-primary", "fingerprint": "a03a7023015b81a9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-5c3e2ded556feb8d", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.5.8 \u2014 package-lock.json"}, "properties": {"repobilityId": "10b93266de05d9b1", "scanner": "scanner-primary", "fingerprint": "5c3e2ded556feb8d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-d4ea3d1c43f14203", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.15.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "9874f96ea2c6eb3f", "scanner": "scanner-primary", "fingerprint": "d4ea3d1c43f14203", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-696edaf1bfda3eab", "level": "error", "message": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "d0b02bd3a646af1f", "scanner": "scanner-primary", "fingerprint": "696edaf1bfda3eab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f88m-g3jw-g9cj"]}}, {"ruleId": "scanner-3c4041c454cda88e", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "properties": {"repobilityId": "da995bb2cfa21f65", "scanner": "scanner-primary", "fingerprint": "3c4041c454cda88e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-0dabf1aa3028515d", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile.dev"}, "properties": {"repobilityId": "4bf8417e2a273f1a", "scanner": "scanner-primary", "fingerprint": "0dabf1aa3028515d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-5fe1868c15227b48", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile.dev"}, "properties": {"repobilityId": "d0957d98ddd58e02", "scanner": "scanner-primary", "fingerprint": "5fe1868c15227b48", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-014b01fe7c256e0c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .windsurf/workflows/clone-website.md"}, "properties": {"repobilityId": "0ac64c9922357960", "scanner": "scanner-primary", "fingerprint": "014b01fe7c256e0c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".windsurf/workflows/clone-website.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d34317262df6979c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .continue/commands/clone-website.md"}, "properties": {"repobilityId": "1bd04d7d0dd349c8", "scanner": "scanner-primary", "fingerprint": "d34317262df6979c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".continue/commands/clone-website.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59a096892e4a68cb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/clone-website/SKILL.md"}, "properties": {"repobilityId": "85d59191705c2602", "scanner": "scanner-primary", "fingerprint": "59a096892e4a68cb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/clone-website/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e8e18c8a8c9f611", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/clone-website/SKILL.md"}, "properties": {"repobilityId": "eb185448f0468b11", "scanner": "scanner-primary", "fingerprint": "0e8e18c8a8c9f611", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/clone-website/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ff7672e17304c68", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .github/skills/clone-website/SKILL.md"}, "properties": {"repobilityId": "75bca47953ccd85d", "scanner": "scanner-primary", "fingerprint": "1ff7672e17304c68", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/skills/clone-website/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-546b152b2aaf5b54", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/commands/clone-website.md"}, "properties": {"repobilityId": "066d678e97ad823c", "scanner": "scanner-primary", "fingerprint": "546b152b2aaf5b54", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/commands/clone-website.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-ea0769065ed41804", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}"}, "properties": {"repobilityId": "7bf21a3204b094b8", "scanner": "scanner-primary", "fingerprint": "ea0769065ed41804", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "5ad4eb66d36c01c7", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "1a2dde2262a0fcf7", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-f3efe9ea558ff477", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-267c-6grr-h53f"}, "properties": {"repobilityId": "3196a26d4a4408f7", "scanner": "scanner-primary", "fingerprint": "f3efe9ea558ff477", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-267c-6grr-h53f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4c56e152cb70c8d", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-26hh-7cqf-hhc6"}, "properties": {"repobilityId": "2c1a5553646e7563", "scanner": "scanner-primary", "fingerprint": "e4c56e152cb70c8d", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-26hh-7cqf-hhc6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e277cb7b746b78d", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-36qx-fr4f-26g5"}, "properties": {"repobilityId": "63d1c5424cc0b484", "scanner": "scanner-primary", "fingerprint": "2e277cb7b746b78d", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-36qx-fr4f-26g5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f966b4e1a91c1b8e", "level": "note", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-3g8h-86w9-wvmq"}, "properties": {"repobilityId": "dd6b5359258fc9a3", "scanner": "scanner-primary", "fingerprint": "f966b4e1a91c1b8e", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3g8h-86w9-wvmq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3679842d77a6f115", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-4633-3j49-mh5q"}, "properties": {"repobilityId": "bf9dff4ccc7b6fe5", "scanner": "scanner-primary", "fingerprint": "3679842d77a6f115", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4633-3j49-mh5q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8e6aff0bb2cb9d6", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-492v-c6pp-mqqv"}, "properties": {"repobilityId": "354619c7fe387ca5", "scanner": "scanner-primary", "fingerprint": "e8e6aff0bb2cb9d6", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-492v-c6pp-mqqv"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a208c6d8f9d86a7", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-4c39-4ccg-62r3"}, "properties": {"repobilityId": "9d8fd554bbd33c85", "scanner": "scanner-primary", "fingerprint": "6a208c6d8f9d86a7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4c39-4ccg-62r3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c1531eb0b1836e5", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-68g3-v927-f742"}, "properties": {"repobilityId": "8e2319aa0e5390c9", "scanner": "scanner-primary", "fingerprint": "8c1531eb0b1836e5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-68g3-v927-f742"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6726a5af7d48326f", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-6gpp-xcg3-4w24"}, "properties": {"repobilityId": "9ebabe9b852482bf", "scanner": "scanner-primary", "fingerprint": "6726a5af7d48326f", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6gpp-xcg3-4w24"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-51ba25bde7aa19f8", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-89xv-2m56-2m9x"}, "properties": {"repobilityId": "3ddc6a2258a913f2", "scanner": "scanner-primary", "fingerprint": "51ba25bde7aa19f8", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-89xv-2m56-2m9x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c6e66d0e52a2f567", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-8h8q-6873-q5fj"}, "properties": {"repobilityId": "c6952a35d9fffa71", "scanner": "scanner-primary", "fingerprint": "c6e66d0e52a2f567", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8h8q-6873-q5fj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d26f87ae3dc469b7", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-955p-x3mx-jcvp"}, "properties": {"repobilityId": "71c99bb30a80a663", "scanner": "scanner-primary", "fingerprint": "d26f87ae3dc469b7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-955p-x3mx-jcvp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64ff9e7779412c8f", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-c4j6-fc7j-m34r"}, "properties": {"repobilityId": "8f90fd523bb15002", "scanner": "scanner-primary", "fingerprint": "64ff9e7779412c8f", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-c4j6-fc7j-m34r"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df134c07827dfe16", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-ffhc-5mcf-pf4q"}, "properties": {"repobilityId": "03e8d4ab7e498b43", "scanner": "scanner-primary", "fingerprint": "df134c07827dfe16", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-ffhc-5mcf-pf4q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2ad8a1dffe9c28e9", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-gx5p-jg67-6x7h"}, "properties": {"repobilityId": "4f2d3dda51b3b9e4", "scanner": "scanner-primary", "fingerprint": "2ad8a1dffe9c28e9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gx5p-jg67-6x7h"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-39ba4159fe872aca", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-h64f-5h5j-jqjh"}, "properties": {"repobilityId": "9dd5eac4d8239815", "scanner": "scanner-primary", "fingerprint": "39ba4159fe872aca", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h64f-5h5j-jqjh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32360048f57dc6b9", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-m99w-x7hq-7vfj"}, "properties": {"repobilityId": "a8e05584e2e68e2d", "scanner": "scanner-primary", "fingerprint": "32360048f57dc6b9", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m99w-x7hq-7vfj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-60531e174c6b1be4", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-mg66-mrh9-m8jx"}, "properties": {"repobilityId": "349c8a3362e7f6e7", "scanner": "scanner-primary", "fingerprint": "60531e174c6b1be4", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mg66-mrh9-m8jx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-915dd9587b1e1d9c", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-p9j2-gv94-2wf4"}, "properties": {"repobilityId": "9e1ee61f9e3d9fd2", "scanner": "scanner-primary", "fingerprint": "915dd9587b1e1d9c", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p9j2-gv94-2wf4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-002e38639f0459b6", "level": "error", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-q4gf-8mx6-v5v3"}, "properties": {"repobilityId": "7925fa73967f1408", "scanner": "scanner-primary", "fingerprint": "002e38639f0459b6", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q4gf-8mx6-v5v3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d2a2169b8478a318", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-q8wf-6r8g-63ch"}, "properties": {"repobilityId": "3c08272b7ddf1476", "scanner": "scanner-primary", "fingerprint": "d2a2169b8478a318", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q8wf-6r8g-63ch"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8a986c258d81e49", "level": "note", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-vfv6-92ff-j949"}, "properties": {"repobilityId": "8019c2465dbe012c", "scanner": "scanner-primary", "fingerprint": "b8a986c258d81e49", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vfv6-92ff-j949"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca4c758a53de9f1d", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.1: GHSA-wfc6-r584-vfw7"}, "properties": {"repobilityId": "99acbb1932822774", "scanner": "scanner-primary", "fingerprint": "ca4c758a53de9f1d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wfc6-r584-vfw7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f520d22202dc0d77", "level": "note", "message": {"text": "Vulnerable dependency @babel/core 7.29.0: GHSA-4x5r-pxfx-6jf8"}, "properties": {"repobilityId": "048ec5a9afac1732", "scanner": "scanner-primary", "fingerprint": "f520d22202dc0d77", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4x5r-pxfx-6jf8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d10b60772a4768e3", "level": "warning", "message": {"text": "Vulnerable dependency @hono/node-server 1.19.11: GHSA-92pp-h63x-v22m"}, "properties": {"repobilityId": "5512559e1ff26ddf", "scanner": "scanner-primary", "fingerprint": "d10b60772a4768e3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-92pp-h63x-v22m", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06dda7175bea3f4d", "level": "warning", "message": {"text": "Vulnerable dependency @hono/node-server 1.19.11: GHSA-frvp-7c67-39w9"}, "properties": {"repobilityId": "acbce5b2ad9dc49c", "scanner": "scanner-primary", "fingerprint": "06dda7175bea3f4d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-frvp-7c67-39w9", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-22d2031218abc77b", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 5.0.5: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "0940821b310c907f", "scanner": "scanner-primary", "fingerprint": "22d2031218abc77b", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5e3d326009ced3b2", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 5.0.5: GHSA-jxxr-4gwj-5jf2"}, "properties": {"repobilityId": "07e03d2ef8e21c6c", "scanner": "scanner-primary", "fingerprint": "5e3d326009ced3b2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jxxr-4gwj-5jf2", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8d77ca63cdd2701", "level": "note", "message": {"text": "Vulnerable dependency body-parser 2.2.2: GHSA-v422-hmwv-36x6"}, "properties": {"repobilityId": "33169ae6017d1ec9", "scanner": "scanner-primary", "fingerprint": "e8d77ca63cdd2701", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v422-hmwv-36x6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e6e15b4938a45354", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "5d2ce580505ef5a7", "scanner": "scanner-primary", "fingerprint": "e6e15b4938a45354", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d0471d67ddb79c72", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v"}, "properties": {"repobilityId": "c4fa6cea7167ee7e", "scanner": "scanner-primary", "fingerprint": "d0471d67ddb79c72", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f886-m6hf-6m8v", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0bcc5916af91f27", "level": "error", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-4c8g-83qw-93j6"}, "properties": {"repobilityId": "ccba8e073dd684ab", "scanner": "scanner-primary", "fingerprint": "e0bcc5916af91f27", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4c8g-83qw-93j6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41060e7beb571855", "level": "error", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-q3j6-qgpj-74h6"}, "properties": {"repobilityId": "9eb02b57c07aeb74", "scanner": "scanner-primary", "fingerprint": "41060e7beb571855", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q3j6-qgpj-74h6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e668e6737d5d8a0d", "level": "error", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v2hh-gcrm-f6hx"}, "properties": {"repobilityId": "c516ccc3502eb13b", "scanner": "scanner-primary", "fingerprint": "e668e6737d5d8a0d", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v2hh-gcrm-f6hx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c15f421d52222fa8", "level": "error", "message": {"text": "Vulnerable dependency fast-uri 3.1.0: GHSA-v39h-62p7-jpjc"}, "properties": {"repobilityId": "06c91e3216e3fe95", "scanner": "scanner-primary", "fingerprint": "c15f421d52222fa8", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v39h-62p7-jpjc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-12fcd89ca280169c", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-26pp-8wgv-hjvm"}, "properties": {"repobilityId": "7504bcc7412aefc6", "scanner": "scanner-primary", "fingerprint": "12fcd89ca280169c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-26pp-8wgv-hjvm", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-93060a617f44f59d", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-2gcr-mfcq-wcc3"}, "properties": {"repobilityId": "d33e49561c382a8d", "scanner": "scanner-primary", "fingerprint": "93060a617f44f59d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2gcr-mfcq-wcc3", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89899c3509d792fe", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-3hrh-pfw6-9m5x"}, "properties": {"repobilityId": "8887dd9634195b37", "scanner": "scanner-primary", "fingerprint": "89899c3509d792fe", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3hrh-pfw6-9m5x", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0de7d1665f27f09d", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-458j-xx4x-4375"}, "properties": {"repobilityId": "6d1a73401fa7bcd4", "scanner": "scanner-primary", "fingerprint": "0de7d1665f27f09d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-458j-xx4x-4375", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3fe797b7f322cbe5", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-69xw-7hcm-h432"}, "properties": {"repobilityId": "58c9c333400725b8", "scanner": "scanner-primary", "fingerprint": "3fe797b7f322cbe5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-69xw-7hcm-h432", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ffaa9e3ba95b1a5a", "level": "error", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-88fw-hqm2-52qc"}, "properties": {"repobilityId": "eeeac44494b3eca5", "scanner": "scanner-primary", "fingerprint": "ffaa9e3ba95b1a5a", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-88fw-hqm2-52qc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-feee81cbbd83b2af", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-9vqf-7f2p-gf9v"}, "properties": {"repobilityId": "d81284a3854e0241", "scanner": "scanner-primary", "fingerprint": "feee81cbbd83b2af", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-9vqf-7f2p-gf9v", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ff232ec048d12413", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-f577-qrjj-4474"}, "properties": {"repobilityId": "69aed0e982ff9673", "scanner": "scanner-primary", "fingerprint": "ff232ec048d12413", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f577-qrjj-4474", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b635e507a20dbd8", "level": "note", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-hm8q-7f3q-5f36"}, "properties": {"repobilityId": "97b4d1ec50a94f7d", "scanner": "scanner-primary", "fingerprint": "7b635e507a20dbd8", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hm8q-7f3q-5f36", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-218236c9dc62e92c", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-hvrm-45r6-mjfj"}, "properties": {"repobilityId": "216d5b16d69dbe59", "scanner": "scanner-primary", "fingerprint": "218236c9dc62e92c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hvrm-45r6-mjfj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bb6800c2b2ab964d", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-j6c9-x7qj-28xf"}, "properties": {"repobilityId": "8dc1654b6f585244", "scanner": "scanner-primary", "fingerprint": "bb6800c2b2ab964d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-j6c9-x7qj-28xf", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ee87c22b02b4162", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-p77w-8qqv-26rm"}, "properties": {"repobilityId": "d2f6910444df7a25", "scanner": "scanner-primary", "fingerprint": "8ee87c22b02b4162", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p77w-8qqv-26rm", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2636aeec1d4a591e", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-qp7p-654g-cw7p"}, "properties": {"repobilityId": "cff28c27e2c6171a", "scanner": "scanner-primary", "fingerprint": "2636aeec1d4a591e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qp7p-654g-cw7p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81b0be2fd5945726", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-r5rp-j6wh-rvv4"}, "properties": {"repobilityId": "e8513879cffe27ac", "scanner": "scanner-primary", "fingerprint": "81b0be2fd5945726", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r5rp-j6wh-rvv4", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9cc7711b79177221", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-rv63-4mwf-qqc2"}, "properties": {"repobilityId": "443dc44d5b7643c6", "scanner": "scanner-primary", "fingerprint": "9cc7711b79177221", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rv63-4mwf-qqc2", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-37f7b267508e776e", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-w62v-xxxg-mg59"}, "properties": {"repobilityId": "9c5de316ae44da5c", "scanner": "scanner-primary", "fingerprint": "37f7b267508e776e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w62v-xxxg-mg59", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b06c2991952f024a", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-wgpf-jwqj-8h8p"}, "properties": {"repobilityId": "ecf7a5c2f349e3bc", "scanner": "scanner-primary", "fingerprint": "b06c2991952f024a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wgpf-jwqj-8h8p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-813a2abba6486159", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-wmmm-f939-6g9c"}, "properties": {"repobilityId": "7447efcaba423d13", "scanner": "scanner-primary", "fingerprint": "813a2abba6486159", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wmmm-f939-6g9c", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1712b388569689c5", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-wwfh-h76j-fc44"}, "properties": {"repobilityId": "3eedb09b2eeb65e0", "scanner": "scanner-primary", "fingerprint": "1712b388569689c5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wwfh-h76j-fc44", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-25e501421a283a0f", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-xf4j-xp2r-rqqx"}, "properties": {"repobilityId": "2af94c8f4afc6080", "scanner": "scanner-primary", "fingerprint": "25e501421a283a0f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xf4j-xp2r-rqqx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb66fc69d0878c89", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-xgm2-5f3f-mvvc"}, "properties": {"repobilityId": "83874b24bab213c1", "scanner": "scanner-primary", "fingerprint": "cb66fc69d0878c89", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xgm2-5f3f-mvvc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f0006346997f8e1a", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-xpcf-pg52-r92g"}, "properties": {"repobilityId": "d399588c9e5f02cf", "scanner": "scanner-primary", "fingerprint": "f0006346997f8e1a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xpcf-pg52-r92g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca9c720e6d5af73a", "level": "warning", "message": {"text": "Vulnerable dependency hono 4.12.9: GHSA-xrhx-7g5j-rcj5"}, "properties": {"repobilityId": "e736a655743dabf1", "scanner": "scanner-primary", "fingerprint": "ca9c720e6d5af73a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xrhx-7g5j-rcj5", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-69081f374cca2aed", "level": "warning", "message": {"text": "Vulnerable dependency ip-address 10.1.0: GHSA-v2v4-37r5-5v8g"}, "properties": {"repobilityId": "5c91c7922f5f2449", "scanner": "scanner-primary", "fingerprint": "69081f374cca2aed", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v2v4-37r5-5v8g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b636a45bdf9c032", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "properties": {"repobilityId": "bb9354b1169e66e2", "scanner": "scanner-primary", "fingerprint": "1b636a45bdf9c032", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-52cp-r559-cp3m", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4d0a19b03f4897fd", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": "2e7af66f705e9148", "scanner": "scanner-primary", "fingerprint": "4d0a19b03f4897fd", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h67p-54hq-rp68", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-94ccd7b7179f963e", "level": "error", "message": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q"}, "properties": {"repobilityId": "86c312e6e8a1e925", "scanner": "scanner-primary", "fingerprint": "94ccd7b7179f963e", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6g55-p6wh-862q", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e9b8f136e566cd89", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93"}, "properties": {"repobilityId": "00a7666aebb4f6a3", "scanner": "scanner-primary", "fingerprint": "e9b8f136e566cd89", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qx2v-qp2m-jg93", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}]}]}