{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-8c797f5b54431d71", "name": "TODO/FIXME marker in shipping code \u2014 fb-chat-api/utils.js:366", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 fb-chat-api/utils.js:366"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-8e44341e7a6522a1", "name": "TODO/FIXME marker in shipping code \u2014 fb-chat-api/src/listenMqtt.js:41", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 fb-chat-api/src/listenMqtt.js:41"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-91387390330a0caf", "name": "detect child process \u2014 Goat.js:37", "shortDescription": {"text": "detect child process \u2014 Goat.js:37"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `pathDir`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-b5198870f9bf83cc", "name": "detect child process \u2014 scripts/cmds/cmd.js:327", "shortDescription": {"text": "detect child process \u2014 scripts/cmds/cmd.js:327"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `fileName`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-a2c5bdc6171b265f", "name": "CVE-2026-3449: @tootallnate/once 1.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-3449: @tootallnate/once 1.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "@tootallnate/once: @tootallnate/once: Denial of Service due to incorrect control flow scoping with AbortSignal\n\nVersions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.\n\nPackage: @tootallnate/once\nInstalled: 1.1.2\nFixed in: 3.0.1, 2.0.1\nSeverity: LOW\nFix: Upgrade @tootallnate/once to 3.0.1, 2.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86bcf83af42dc2eb", "name": "CVE-2025-69873: ajv 6.12.6 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-69873: ajv 6.12.6 \u2014 package-lock.json"}, "fullDescription": {"text": "ajv: ReDoS via $data reference\n\najv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds\n\nPackage: ajv\nInstalled: 6.12.6\nFixed in: 8.18.0, 6.14.0\nSeverity: MEDIUM\nFix: Upgrade ajv to 8.18.0, 6.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cea3613d60a67484", "name": "CVE-2024-39338: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-39338: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: axios: Server-Side Request Forgery\n\naxios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.7.4\nSeverity: HIGH\nFix: Upgrade axios to 1.7.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-03fda173b539cc35", "name": "CVE-2025-27152: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-27152: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests\n\naxios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if \u2060baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.8.2, 0.30.0\nSeverity: HIGH\nFix: Upgrade axios to 1.8.2, 0.30.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-48882f66f92ac0ec", "name": "CVE-2025-58754: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-58754: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios DoS via lack of data size check\n\nAxios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI a\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.12.0, 0.30.2\nSeverity: HIGH\nFix: Upgrade axios to 1.12.0, 0.30.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b1ea201195619a7b", "name": "CVE-2026-25639: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-25639: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.13.5, 0.30.3\nSeverity: HIGH\nFix: Upgrade axios to 1.13.5, 0.30.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1380111c1617de81", "name": "CVE-2026-42033: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42033: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same \n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2eb9f6dc9a77d06e", "name": "CVE-2026-42035: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42035: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance an\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-11abd60530a4eb0f", "name": "CVE-2026-42043: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42043: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: NO_PROXY bypass via crafted URL\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d15871fbbc6ad0df", "name": "CVE-2026-42264: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42264: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Prototype pollution allows information disclosure and request manipulation\n\nAxios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.2\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-72e4060584f21f4d", "name": "CVE-2026-44486: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44486: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019 Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. T\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-65575422d10cde60", "name": "CVE-2026-44487: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44487: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was in\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7157792fe24dda6b", "name": "CVE-2026-44494: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44494: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack \u2014 intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, whic\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.16.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a1f9d13ff483226a", "name": "CVE-2026-44495: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44495: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability\n\nAxios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-p\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.2, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ca1a96e7b876978a", "name": "CVE-2026-44496: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44496: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-afa580af5ddbefdc", "name": "CVE-2023-45857: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-45857: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: exposure of confidential data stored in cookies\n\nAn issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.6.0, 0.28.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.6.0, 0.28.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-277d26cdfbd8e00a", "name": "CVE-2025-62718: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-62718: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This is\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65e4aec041a94daf", "name": "CVE-2026-40175: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-40175: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation\n\nAxios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-12c068e1aed69b53", "name": "CVE-2026-42034: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42034: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-629f001407e7fc1c", "name": "CVE-2026-42036: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42036: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-12a4842e4110cad2", "name": "CVE-2026-42037: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42037: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypa\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2fd974d015c705a5", "name": "CVE-2026-42038: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42038: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to `no_proxy` bypass\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching \u2014 it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-855ae52cd5e0c22f", "name": "CVE-2026-42039: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42039: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-056e7a7be728ea68", "name": "CVE-2026-42041: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42041: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9829c8a4091a8f9", "name": "CVE-2026-42042: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42042: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: XSRF token bypass leading to information disclosure\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin s\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42e2e333fc6d66f8", "name": "CVE-2026-42044: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42044: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses \u2014 including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, \n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.2\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6cf1d392f6ddce5", "name": "CVE-2026-44490: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44490: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure and denial of service due to prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the mer\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.16.0, 0.32.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e74829e722c6282", "name": "CVE-2026-67312: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-67312: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: axios: Denial of Service via uncontrolled recursion in form data processing\n\naxios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and c\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-10bf4cff73d78070", "name": "CVE-2026-67313: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-67313: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios versions 0.28.0 and later contain uncontrolled recursion in form ...\n\naxios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-990991581948cf91", "name": "CVE-2026-67316: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-67316: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection\n\naxios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling export\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.18.0, 0.33.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0, 0.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cd83f710da84e71", "name": "CVE-2026-67319: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-67319: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: axios: Information disclosure and data manipulation via prototype pollution\n\naxios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited user\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d4726b2d323faa39", "name": "CVE-2026-42040: axios 1.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42040: axios 1.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "axios: Axios: Incorrect null byte handling can lead to data integrity issues\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerab\n\nPackage: axios\nInstalled: 1.4.0\nFixed in: 1.15.1, 0.31.1\nSeverity: LOW\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-897bd6dfb595e55b", "name": "CVE-2024-45590: body-parser 1.20.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-45590: body-parser 1.20.1 \u2014 package-lock.json"}, "fullDescription": {"text": "body-parser: Denial of Service Vulnerability in body-parser\n\nbody-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.\n\nPackage: body-parser\nInstalled: 1.20.1\nFixed in: 1.20.3\nSeverity: HIGH\nFix: Upgrade body-parser to 1.20.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5b0ae2d774d3f213", "name": "CVE-2026-12590: body-parser 1.20.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-12590: body-parser 1.20.1 \u2014 package-lock.json"}, "fullDescription": {"text": "body-parser: body-parser: Denial of Service via invalid limit option\n\nImpact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars\n\nPackage: body-parser\nInstalled: 1.20.1\nFixed in: 1.20.6, 2.3.0\nSeverity: LOW\nFix: Upgrade body-parser to 1.20.6, 2.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41aeed0cdec09958", "name": "CVE-2026-13149: brace-expansion 1.1.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 1.1.11 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e129f76ffd62afa3", "name": "CVE-2026-14257: brace-expansion 1.1.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-14257: brace-expansion 1.1.11 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function\n\nbrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of i\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 5.0.8, 3.0.3, 2.1.3, 1.1.17\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.8, 3.0.3, 2.1.3, 1.1.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-53a565b68abde6fa", "name": "CVE-2026-69152: brace-expansion 1.1.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-69152: brace-expansion 1.1.11 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 1.1.18, 2.1.4, 3.0.6, 5.0.9\nSeverity: HIGH\nFix: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, 5.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e0d93e508ef6102", "name": "CVE-2026-33750: brace-expansion 1.1.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 1.1.11 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-157cac5b75a99569", "name": "CVE-2025-5889: brace-expansion 1.1.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-5889: brace-expansion 1.1.11 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: juliangruber brace-expansion index.js expand redos\n\nA vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 i\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 2.0.2, 1.1.12, 3.0.1, 4.0.1\nSeverity: LOW\nFix: Upgrade brace-expansion to 2.0.2, 1.1.12, 3.0.1, 4.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f32b69251dba4d22", "name": "CVE-2024-47764: cookie 0.4.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-47764: cookie 0.4.1 \u2014 package-lock.json"}, "fullDescription": {"text": "cookie: cookie accepts cookie name, path, and domain with out of bounds characters\n\ncookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.\n\nPackage: cookie\nInstalled: 0.4.1\nFixed in: 0.7.0\nSeverity: LOW\nFix: Upgrade cookie to 0.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe93d5e2ad997fca", "name": "CVE-2024-47764: cookie 0.4.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-47764: cookie 0.4.2 \u2014 package-lock.json"}, "fullDescription": {"text": "cookie: cookie accepts cookie name, path, and domain with out of bounds characters\n\ncookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.\n\nPackage: cookie\nInstalled: 0.4.2\nFixed in: 0.7.0\nSeverity: LOW\nFix: Upgrade cookie to 0.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19d16e0e0475ce77", "name": "CVE-2024-47764: cookie 0.5.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-47764: cookie 0.5.0 \u2014 package-lock.json"}, "fullDescription": {"text": "cookie: cookie accepts cookie name, path, and domain with out of bounds characters\n\ncookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.\n\nPackage: cookie\nInstalled: 0.5.0\nFixed in: 0.7.0\nSeverity: LOW\nFix: Upgrade cookie to 0.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0340199ca2ddda87", "name": "CVE-2023-26132: dottie 2.0.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-26132: dottie 2.0.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Versions of the package dottie before 2.0.4 are vulnerable to Prototyp ...\n\nVersions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.\n\nPackage: dottie\nInstalled: 2.0.3\nFixed in: 2.0.4\nSeverity: HIGH\nFix: Upgrade dottie to 2.0.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-819523fc72181790", "name": "CVE-2026-59725: engine.io 6.4.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59725: engine.io 6.4.1 \u2014 package-lock.json"}, "fullDescription": {"text": "socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests\n\nSocket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.\n\nPackage: engine.io\nInstalled: 6.4.1\nFixed in: 6.6.7\nSeverity: HIGH\nFix: Upgrade engine.io to 6.6.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-636841d6933ebb3a", "name": "CVE-2023-31125: engine.io 6.4.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-31125: engine.io 6.4.1 \u2014 package-lock.json"}, "fullDescription": {"text": "engine.io: Uncaught exception in engine.io\n\nEngine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package, including those who use d\n\nPackage: engine.io\nInstalled: 6.4.1\nFixed in: 6.4.2\nSeverity: MEDIUM\nFix: Upgrade engine.io to 6.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-378dbc04593eca53", "name": "CVE-2022-25967: eta 1.12.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-25967: eta 1.12.3 \u2014 package-lock.json"}, "fullDescription": {"text": "eta: Remote Code Execution by overwriting template engine configuration variables\n\nVersions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API.\r\r**Note:** This is exploitable only for users who are rendering templates with user-defined data.\n\nPackage: eta\nInstalled: 1.12.3\nFixed in: 2.0.0\nSeverity: HIGH\nFix: Upgrade eta to 2.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2e32f38f6438c08c", "name": "CVE-2023-23630: eta 1.12.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-23630: eta 1.12.3 \u2014 package-lock.json"}, "fullDescription": {"text": "XSS Attack with Express API\n\nEta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.\n\nPackage: eta\nInstalled: 1.12.3\nFixed in: 2.0.0\nSeverity: HIGH\nFix: Upgrade eta to 2.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa70dd8968a95a7a", "name": "CVE-2024-29041: express 4.18.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-29041: express 4.18.2 \u2014 package-lock.json"}, "fullDescription": {"text": "express: cause malformed URLs to be evaluated\n\nExpress.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redir\n\nPackage: express\nInstalled: 4.18.2\nFixed in: 4.19.2, 5.0.0-beta.3\nSeverity: MEDIUM\nFix: Upgrade express to 4.19.2, 5.0.0-beta.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-339546f1a7d7e542", "name": "CVE-2024-43796: express 4.18.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-43796: express 4.18.2 \u2014 package-lock.json"}, "fullDescription": {"text": "express: Improper Input Handling in Express Redirects\n\nExpress.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.\n\nPackage: express\nInstalled: 4.18.2\nFixed in: 4.20.0, 5.0.0\nSeverity: LOW\nFix: Upgrade express to 4.20.0, 5.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb01fa29d31e630f", "name": "CVE-2026-33036: fast-xml-parser 4.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33036: fast-xml-parser 4.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass\n\nfast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces \n\nPackage: fast-xml-parser\nInstalled: 4.1.2\nFixed in: 5.5.6, 4.5.5\nSeverity: HIGH\nFix: Upgrade fast-xml-parser to 5.5.6, 4.5.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-20a7add84e12cc51", "name": "CVE-2026-33349: fast-xml-parser 4.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33349: fast-xml-parser 4.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling\n\nfast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 \u2014 intending to disallow all entities or restrict entity size to zero bytes \u2014 the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, co\n\nPackage: fast-xml-parser\nInstalled: 4.1.2\nFixed in: 4.5.5, 5.5.7\nSeverity: MEDIUM\nFix: Upgrade fast-xml-parser to 4.5.5, 5.5.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4a8b4397687e9c2", "name": "CVE-2026-41650: fast-xml-parser 4.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-41650: fast-xml-parser 4.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences\n\nfast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the \"-->\" sequence in comment content or the \"]]>\" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.\n\nPackage: fast-xml-parser\nInstalled: 4.1.2\nFixed in: 5.7.0\nSeverity: MEDIUM\nFix: Upgrade fast-xml-parser to 5.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0e166f708b42f9a", "name": "CVE-2026-27942: fast-xml-parser 4.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27942: fast-xml-parser 4.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service\n\nfast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.\n\nPackage: fast-xml-parser\nInstalled: 4.1.2\nFixed in: 5.3.8, 4.5.4\nSeverity: LOW\nFix: Upgrade fast-xml-parser to 5.3.8, 4.5.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73a0b218d8ffc0a3", "name": "CVE-2023-26159: follow-redirects 1.15.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-26159: follow-redirects 1.15.2 \u2014 package-lock.json"}, "fullDescription": {"text": "follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse()\n\nVersions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.\n\nPackage: follow-redirects\nInstalled: 1.15.2\nFixed in: 1.15.4\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.15.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17cbd36c3eff6ce5", "name": "CVE-2024-28849: follow-redirects 1.15.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-28849: follow-redirects 1.15.2 \u2014 package-lock.json"}, "fullDescription": {"text": "follow-redirects: Possible credential leak\n\nfollow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\nPackage: follow-redirects\nInstalled: 1.15.2\nFixed in: 1.15.6\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.15.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18c1bc683d27c5a0", "name": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.2 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.2 \u2014 package-lock.json"}, "fullDescription": {"text": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets\n\n## Summary\n\nWhen an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target.\n\nSince `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem.\n\n##\n\nPackage: follow-redirects\nInstalled: 1.15.2\nFixed in: 1.16.0\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eacfd54ee0109df3", "name": "CVE-2025-7783: form-data 2.3.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-7783: form-data 2.3.3 \u2014 package-lock.json"}, "fullDescription": {"text": "form-data: Unsafe random function in form-data\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.\n\nPackage: form-data\nInstalled: 2.3.3\nFixed in: 2.5.4, 3.0.4, 4.0.4\nSeverity: CRITICAL\nFix: Upgrade form-data to 2.5.4, 3.0.4, 4.0.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-07b67bc2a5f882e9", "name": "CVE-2026-12143: form-data 2.3.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-12143: form-data 2.3.3 \u2014 package-lock.json"}, "fullDescription": {"text": "form-data: form-data: Form field override via CRLF injection\n\nform-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta\n\nPackage: form-data\nInstalled: 2.3.3\nFixed in: 2.5.6, 3.0.5, 4.0.6\nSeverity: HIGH\nFix: Upgrade form-data to 2.5.6, 3.0.5, 4.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-297f4060ca5cc7d6", "name": "CVE-2025-7783: form-data 4.0.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-7783: form-data 4.0.0 \u2014 package-lock.json"}, "fullDescription": {"text": "form-data: Unsafe random function in form-data\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.\n\nPackage: form-data\nInstalled: 4.0.0\nFixed in: 2.5.4, 3.0.4, 4.0.4\nSeverity: CRITICAL\nFix: Upgrade form-data to 2.5.4, 3.0.4, 4.0.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-84b3c23f6d6cc724", "name": "CVE-2026-12143: form-data 4.0.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-12143: form-data 4.0.0 \u2014 package-lock.json"}, "fullDescription": {"text": "form-data: form-data: Form field override via CRLF injection\n\nform-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta\n\nPackage: form-data\nInstalled: 4.0.0\nFixed in: 2.5.6, 3.0.5, 4.0.6\nSeverity: HIGH\nFix: Upgrade form-data to 2.5.6, 3.0.5, 4.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f643b6996cbd2a0d", "name": "CVE-2024-29415: ip 2.0.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-29415: ip 2.0.0 \u2014 package-lock.json"}, "fullDescription": {"text": "node-ip: Incomplete fix for CVE-2023-42282\n\nThe ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.\n\nPackage: ip\nInstalled: 2.0.0\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c0759cb88bff45cf", "name": "CVE-2023-42282: ip 2.0.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-42282: ip 2.0.0 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-ip: arbitrary code execution via the isPublic() function\n\nThe ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.\n\nPackage: ip\nInstalled: 2.0.0\nFixed in: 2.0.1, 1.1.9\nSeverity: LOW\nFix: Upgrade ip to 2.0.1, 1.1.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb7b90e2c5dad2f5", "name": "CVE-2025-65945: jws 4.0.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-65945: jws 4.0.0 \u2014 package-lock.json"}, "fullDescription": {"text": "node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm\n\nauth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verif\n\nPackage: jws\nInstalled: 4.0.0\nFixed in: 3.2.3, 4.0.1\nSeverity: HIGH\nFix: Upgrade jws to 3.2.3, 4.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bdb0ff330db7f641", "name": "CVE-2026-4800: lodash 4.17.21 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-4800: lodash 4.17.21 \u2014 package-lock.json"}, "fullDescription": {"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports\n\nImpact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith t\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: HIGH\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-488c54428fc34f0d", "name": "CVE-2025-13465: lodash 4.17.21 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-13465: lodash 4.17.21 \u2014 package-lock.json"}, "fullDescription": {"text": "lodash: prototype pollution in _.unset and _.omit functions\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset\u00a0and _.omit\u00a0functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.17.23\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.17.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8832f52283a5d751", "name": "CVE-2026-2950: lodash 4.17.21 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-2950: lodash 4.17.21 \u2014 package-lock.json"}, "fullDescription": {"text": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass\n\nImpact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prot\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64ecea76e6bc5e09", "name": "CVE-2026-26996: minimatch 3.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-26996: minimatch 3.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) \n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5547d992435923f9", "name": "CVE-2026-27903: minimatch 3.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27903: minimatch 3.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call\n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc1422d1987f9a44", "name": "CVE-2026-27904: minimatch 3.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27904: minimatch 3.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe\n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b17dadd5b14d4afa", "name": "CVE-2021-32050: mongodb 4.14.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2021-32050: mongodb 4.14.0 \u2014 package-lock.json"}, "fullDescription": {"text": "Some MongoDB Drivers may erroneously publish events containing authent ...\n\nSome MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.\n\nWithout due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default).\n\nThis \n\nPackage: mongodb\nInstalled: 4.14.0\nFixed in: 3.6.10, 4.17.0, 5.8.0\nSeverity: MEDIUM\nFix: Upgrade mongodb to 3.6.10, 4.17.0, 5.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aff434348edaaeed", "name": "CVE-2023-3696: mongoose 6.10.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-3696: mongoose 6.10.5 \u2014 package-lock.json"}, "fullDescription": {"text": "Mongoose Prototype Pollution vulnerability\n\nPrototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.\n\nPackage: mongoose\nInstalled: 6.10.5\nFixed in: 7.3.3, 6.11.3, 5.13.20\nSeverity: CRITICAL\nFix: Upgrade mongoose to 7.3.3, 6.11.3, 5.13.20"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-fef1168e421a314b", "name": "CVE-2025-23061: mongoose 6.10.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-23061: mongoose 6.10.5 \u2014 package-lock.json"}, "fullDescription": {"text": "Mongoose search injection vulnerability\n\nMongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.\n\nPackage: mongoose\nInstalled: 6.10.5\nFixed in: 8.9.5, 7.8.4, 6.13.6\nSeverity: CRITICAL\nFix: Upgrade mongoose to 8.9.5, 7.8.4, 6.13.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-e9eb77afaa18ef1c", "name": "CVE-2024-53900: mongoose 6.10.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-53900: mongoose 6.10.5 \u2014 package-lock.json"}, "fullDescription": {"text": "Mongoose search injection vulnerability\n\nMongoose before 8.8.3 can improperly use $where in match, leading to search injection.\n\nPackage: mongoose\nInstalled: 6.10.5\nFixed in: 8.8.3, 7.8.3, 6.13.5, 5.13.23\nSeverity: HIGH\nFix: Upgrade mongoose to 8.8.3, 7.8.3, 6.13.5, 5.13.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06e87146f6f79f28", "name": "CVE-2026-42334: mongoose 6.10.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42334: mongoose 6.10.5 \u2014 package-lock.json"}, "fullDescription": {"text": "Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection\n\nMongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose\u2019s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), \n\nPackage: mongoose\nInstalled: 6.10.5\nFixed in: 6.13.9, 7.8.9, 8.22.1, 9.1.6\nSeverity: HIGH\nFix: Upgrade mongoose to 6.13.9, 7.8.9, 8.22.1, 9.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f06bb598913935b2", "name": "CVE-2026-73562: mongoose 6.10.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-73562: mongoose 6.10.5 \u2014 package-lock.json"}, "fullDescription": {"text": "Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)\n\nMongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose update casting with a __proto__.x dotted path under $set. Schema.prototype.path and Schema.prototype._getPathType can treat inherited properties of schema.paths and schema.nested as schema types, allowing the casting process to set $fullPath and $parentSchemaDocArr\n\nPackage: mongoose\nInstalled: 6.10.5\nFixed in: 6.13.10, 7.8.10, 8.24.1, 9.7.2\nSeverity: MEDIUM\nFix: Upgrade mongoose to 6.13.10, 7.8.10, 8.24.1, 9.7.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b51ba123c372d459", "name": "CVE-2025-12816: node-forge 1.3.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-12816: node-forge 1.3.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications\n\nAn interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.\n\nPackage: node-forge\nInstalled: 1.3.1\nFixed in: 1.3.2\nSeverity: HIGH\nFix: Upgrade node-forge to 1.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7e6ac772c3c6a67c", "name": "CVE-2025-66031: node-forge 1.3.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-66031: node-forge 1.3.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-forge: node-forge ASN.1 Unbounded Recursion\n\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.\n\nPackage: node-forge\nInstalled: 1.3.1\nFixed in: 1.3.2\nSeverity: HIGH\nFix: Upgrade node-forge to 1.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ae057a9cd3e8ed27", "name": "CVE-2026-33891: node-forge 1.3.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33891: node-forge 1.3.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse()\n\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100%\n\nPackage: node-forge\nInstalled: 1.3.1\nFixed in: 1.4.0\nSeverity: HIGH\nFix: Upgrade node-forge to 1.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0b1a2cd7c4d84f70", "name": "CVE-2026-33894: node-forge 1.3.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33894: node-forge 1.3.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification\n\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing \u201cgarbage\u201d bytes within the ASN structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within th\n\nPackage: node-forge\nInstalled: 1.3.1\nFixed in: 1.4.0\nSeverity: HIGH\nFix: Upgrade node-forge to 1.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-59942bc063cd210c", "name": "CVE-2026-33895: node-forge 1.3.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33895: node-forge 1.3.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures\n\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by the specification. This class of signature malleability has been exploited in p\n\nPackage: node-forge\nInstalled: 1.3.1\nFixed in: 1.4.0\nSeverity: HIGH\nFix: Upgrade node-forge to 1.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06858e62a94339d7", "name": "CVE-2026-33896: node-forge 1.3.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33896: node-forge 1.3.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance\n\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.\n\nPackage: node-forge\nInstalled: 1.3.1\nFixed in: 1.4.0\nSeverity: HIGH\nFix: Upgrade node-forge to 1.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-270e43a709d2cf45", "name": "CVE-2025-66030: node-forge 1.3.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-66030: node-forge 1.3.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-forge: node-forge: Integer Overflow allows OID-based security bypass\n\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.\n\nPackage: node-forge\nInstalled: 1.3.1\nFixed in: 1.3.2\nSeverity: MEDIUM\nFix: Upgrade node-forge to 1.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f88342e1b2334cc", "name": "CVE-2025-14874: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-14874: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "nodemailer: Nodemailer: Denial of service via crafted email address header\n\nA flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.\n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 7.0.11\nSeverity: HIGH\nFix: Upgrade nodemailer to 7.0.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1c17d43db6b3c3de", "name": "CVE-2026-82659: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-82659: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "nodemailer: Nodemailer: Arbitrary file read and Server-Side Request Forgery via raw option bypass\n\nnodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.\n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 9.0.1\nSeverity: HIGH\nFix: Upgrade nodemailer to 9.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2e12b82772d34e0c", "name": "GHSA-2x7j-588g-ccc2: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-2x7j-588g-ccc2: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Nodemailer: Quadratic (O(n\u00b2)) time complexity in addressparser allows remote denial of service via a crafted address list\n\n### Summary\n\nNodemailer's address parser (`lib/addressparser/index.js`) parses a list of comma\u2011separated addresses in **quadratic time \u2014 O(n\u00b2)** in the number of addresses. A single crafted address string (e.g. a `To`, `Cc`, `Bcc`, `From`, or `Reply\u2011To` value, or any value passed to the exported `addressparser`) therefore consumes CPU proportional to the **square** of its length and blocks Node's single\u2011threaded event loop for the entire duration, denying service to every other request in the pr\n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 9.1.0\nSeverity: HIGH\nFix: Upgrade nodemailer to 9.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c2eef2c5806709e7", "name": "CVE-2025-13033: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-13033: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "nodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict\n\nA vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and a\n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 7.0.7\nSeverity: MEDIUM\nFix: Upgrade nodemailer to 7.0.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a307a524196211b0", "name": "GHSA-268h-hp4c-crq3: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-268h-hp4c-crq3: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection\n\n### Summary\n\nNodemailer constructs `List-*` headers from the caller-provided `list` message option using internally prepared header values. The `list.*.comment` field is inserted into those prepared values without removing CR (`\\r`) or LF (`\\n`) characters. Because prepared headers bypass the normal header-value sanitizer and are passed to `mimeFuncs.foldLines()`, a CRLF sequence in a list comment is emitted as an actual header boundary in the generated RFC822 message.\n\nAn application that lets \n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 8.0.9\nSeverity: MEDIUM\nFix: Upgrade nodemailer to 8.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e62d90c0dc11ec7", "name": "GHSA-8m3c-c648-2xjj: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-8m3c-c648-2xjj: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature\n\n### Summary\n\nNodemailer's `disableFileAccess` / `disableUrlAccess` options are a security sandbox that lets an application forbid untrusted message content (`html`/`text`/attachment `path`/`href`) from reading local files or making outbound HTTP(S) requests. The fix for GHSA-wqvq-jvpq-h66f (commit `5f69497`) threaded these flags through the library's internal resolution paths (`MailMessage.resolveAll()` and `_convertDataImages()`), but the public plugin API `MailMessage.resolveContent(...args)` \n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 9.1.1\nSeverity: MEDIUM\nFix: Upgrade nodemailer to 9.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b08e08ee332e5c41", "name": "GHSA-9h6g-pr28-7cqp: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-9h6g-pr28-7cqp: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "nodemailer ReDoS when trying to send a specially crafted email\n\n### Summary\nA ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter `attachDataUrls` set, causing the stuck of event loop. \nAnother flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop. \n\n### Details\n\nRegex: /^data:((?:[^;]*;)*(?:[^,]*)),(.*)$/\n\nPath: compile -> getAttachments -> _processDataUrl\n\nRegex: /(<img\\b[^>]* src\\s*=[\\s\"']*)(data:([^;]+);[^\"'>\\s]+)/\n\nPath: _convertDataImages\n\n### PoC\n\nhttps://g\n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 6.9.9\nSeverity: MEDIUM\nFix: Upgrade nodemailer to 6.9.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e224b5b1c713845f", "name": "GHSA-r7g4-qg5f-qqm2: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-r7g4-qg5f-qqm2: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception\n\n### Summary\nNodemailer disables TLS certificate verification in its internal HTTPS fetch client through the use of rejectUnauthorized: false inside lib/fetch/index.js.\n\nAs a result, OAuth2 token requests trust invalid or self-signed HTTPS certificates and transmit sensitive OAuth credentials over connections that should fail TLS validation.\n\nAn attacker in a machine-in-the-middle position can intercept OAuth2 credential exchanges and capture:\n\n- OAuth client_secret\n- refresh_token\n- access token\n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 8.0.8\nSeverity: MEDIUM\nFix: Upgrade nodemailer to 8.0.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-102ae7f83eaabbd3", "name": "GHSA-vvjj-xcjg-gr5g: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-vvjj-xcjg-gr5g: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) \n\n### Summary\n\nNodemailer versions up to and including 8.0.4 are vulnerable to SMTP command injection via CRLF sequences in the transport `name` configuration option. The `name` value is used directly in the EHLO/HELO SMTP command without any sanitization for carriage return and line feed characters (`\\r\\n`). An attacker who can influence this option can inject arbitrary SMTP commands, enabling unauthorized email sending, email spoofing, and phishing attacks.\n\n### Details\n\nThe vulnerability exists\n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 8.0.5\nSeverity: MEDIUM\nFix: Upgrade nodemailer to 8.0.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-701cec4a808bafec", "name": "GHSA-wmmp-3585-3rmp: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-wmmp-3585-3rmp: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain\n\n### Summary\n\nNodemailer resolves an international (IDN / non-ASCII) recipient **domain** to a different Punycode `xn--` label than every UTS\u201146\u2011conformant parser (web browsers, the WHATWG URL Standard, Node's `url.domainToASCII`, Python's `idna`). Its address normalizer (`_normalizeAddress` in `lib/mime-node/index.js`) uses the bundled **raw RFC\u20113492 Punycode codec with no UTS\u201146 mapping/normalization**, so a domain that a standards\u2011compliant validator maps to a trusted domain is delivered by No\n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 9.1.0\nSeverity: MEDIUM\nFix: Upgrade nodemailer to 9.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf53a4fd37b3f341", "name": "GHSA-wqvq-jvpq-h66f: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-wqvq-jvpq-h66f: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization\n\n### Summary\n\nNodemailer's `disableFileAccess` and `disableUrlAccess` options are intended to prevent message content and attachments from reading local files or fetching URLs. The normal MIME streaming path enforces those options in `MimeNode._getStream()`. However, `jsonTransport` serializes messages by calling `mail.normalize()`, which resolves `html`, `text`, alternatives, calendar events, and attachments through `shared.resolveContent()` before MIME generation. `shared.resolveContent()` read\n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 8.0.9\nSeverity: MEDIUM\nFix: Upgrade nodemailer to 8.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89f5e8aa72414011", "name": "GHSA-c7w3-x93f-qmm8: nodemailer 6.9.1 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-c7w3-x93f-qmm8: nodemailer 6.9.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter\n\n### Summary\nWhen a custom `envelope` object is passed to `sendMail()` with a `size` property containing CRLF characters (`\\r\\n`), the value is concatenated directly into the SMTP `MAIL FROM` command without sanitization. This allows injection of arbitrary SMTP commands, including `RCPT TO` \u2014 silently adding attacker-controlled recipients to outgoing emails.\n\n\n### Details\nIn `lib/smtp-connection/index.js` (lines 1161-1162), the `envelope.size` value is concatenated into the SMTP `MAIL FROM` comma\n\nPackage: nodemailer\nInstalled: 6.9.1\nFixed in: 8.0.4\nSeverity: LOW\nFix: Upgrade nodemailer to 8.0.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-670db14a265d87ba", "name": "CVE-2025-7339: on-headers 1.0.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-7339: on-headers 1.0.2 \u2014 package-lock.json"}, "fullDescription": {"text": "on-headers: on-headers vulnerable to http response header manipulation\n\non-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`.\u00a0Users should upgrade to version 1.1.0 to receive a patch.\u00a0Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.\n\nPackage: on-headers\nInstalled: 1.0.2\nFixed in: 1.1.0\nSeverity: LOW\nFix: Upgrade on-headers to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7776210b363cdbb0", "name": "CVE-2024-45296: path-to-regexp 0.1.7 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-45296: path-to-regexp 0.1.7 \u2014 package-lock.json"}, "fullDescription": {"text": "path-to-regexp: Backtracking regular expressions cause ReDoS\n\npath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1\n\nPackage: path-to-regexp\nInstalled: 0.1.7\nFixed in: 1.9.0, 0.1.10, 8.0.0, 3.3.0, 6.3.0\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 1.9.0, 0.1.10, 8.0.0, 3.3.0, 6.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-706b8c2de5621524", "name": "CVE-2024-52798: path-to-regexp 0.1.7 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-52798: path-to-regexp 0.1.7 \u2014 package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x\n\npath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.\n\nPackage: path-to-regexp\nInstalled: 0.1.7\nFixed in: 0.1.12\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 0.1.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea0301ce2a43bdb7", "name": "CVE-2026-4867: path-to-regexp 0.1.7 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-4867: path-to-regexp 0.1.7 \u2014 package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters\n\nImpact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\n\n\nPackage: path-to-regexp\nInstalled: 0.1.7\nFixed in: 0.1.13\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 0.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-65aa59d9cc789369", "name": "CVE-2025-15284: qs 6.11.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-15284: qs 6.11.0 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper input validation in array parsing\n\nImproper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la\n\nPackage: qs\nInstalled: 6.11.0\nFixed in: 6.14.1\nSeverity: MEDIUM\nFix: Upgrade qs to 6.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65f53e3e6ca4b192", "name": "CVE-2026-82417: qs 6.11.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-82417: qs 6.11.0 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper validation in stringify function\n\n### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-pr\n\nPackage: qs\nInstalled: 6.11.0\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade qs to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ee6dd2ee8a0e64e", "name": "CVE-2026-2391: qs 6.11.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-2391: qs 6.11.0 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs's arrayLimit bypass in comma parsing allows denial of service\n\n### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?\n\nPackage: qs\nInstalled: 6.11.0\nFixed in: 6.14.2\nSeverity: LOW\nFix: Upgrade qs to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-688648ec21c7285f", "name": "CVE-2025-15284: qs 6.11.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-15284: qs 6.11.1 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper input validation in array parsing\n\nImproper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la\n\nPackage: qs\nInstalled: 6.11.1\nFixed in: 6.14.1\nSeverity: MEDIUM\nFix: Upgrade qs to 6.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e5c9c7a2ac4eee96", "name": "CVE-2026-82417: qs 6.11.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-82417: qs 6.11.1 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper validation in stringify function\n\n### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-pr\n\nPackage: qs\nInstalled: 6.11.1\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade qs to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1770f81aa9e98fe", "name": "CVE-2026-8723: qs 6.11.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-8723: qs 6.11.1 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service due to improper handling of null/undefined array elements\n\n### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti\n\nPackage: qs\nInstalled: 6.11.1\nFixed in: 6.15.2\nSeverity: MEDIUM\nFix: Upgrade qs to 6.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09aa358d2e367503", "name": "CVE-2026-2391: qs 6.11.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-2391: qs 6.11.1 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs's arrayLimit bypass in comma parsing allows denial of service\n\n### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?\n\nPackage: qs\nInstalled: 6.11.1\nFixed in: 6.14.2\nSeverity: LOW\nFix: Upgrade qs to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63d7b9a9c2bc39e8", "name": "CVE-2025-15284: qs 6.5.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-15284: qs 6.5.3 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper input validation in array parsing\n\nImproper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la\n\nPackage: qs\nInstalled: 6.5.3\nFixed in: 6.14.1\nSeverity: MEDIUM\nFix: Upgrade qs to 6.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6163ef8b2dafc4a7", "name": "CVE-2026-82417: qs 6.5.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-82417: qs 6.5.3 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper validation in stringify function\n\n### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-pr\n\nPackage: qs\nInstalled: 6.5.3\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade qs to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0116a8aecb6cc84f", "name": "CVE-2023-28155: request 2.88.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-28155: request 2.88.2 \u2014 package-lock.json"}, "fullDescription": {"text": "request: bypass of SSRF mitigations when following a cross-protocol redirect\n\nThe Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\nPackage: request\nInstalled: 2.88.2\nFixed in: \u2014\nSeverity: MEDIUM\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-844a9decbf372f9e", "name": "CVE-2022-25883: semver 6.3.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-25883: semver 6.3.0 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-semver: Regular expression denial of service\n\nVersions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\nPackage: semver\nInstalled: 6.3.0\nFixed in: 7.5.2, 6.3.1, 5.7.2\nSeverity: HIGH\nFix: Upgrade semver to 7.5.2, 6.3.1, 5.7.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9dbab1111c2e120b", "name": "CVE-2022-25883: semver 7.5.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2022-25883: semver 7.5.0 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-semver: Regular expression denial of service\n\nVersions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\nPackage: semver\nInstalled: 7.5.0\nFixed in: 7.5.2, 6.3.1, 5.7.2\nSeverity: HIGH\nFix: Upgrade semver to 7.5.2, 6.3.1, 5.7.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d371c9eded98dda0", "name": "CVE-2024-43799: send 0.18.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-43799: send 0.18.0 \u2014 package-lock.json"}, "fullDescription": {"text": "send: Code Execution Vulnerability in Send Library\n\nSend is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.\n\nPackage: send\nInstalled: 0.18.0\nFixed in: 0.19.0\nSeverity: LOW\nFix: Upgrade send to 0.19.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b4d31608e575af1", "name": "CVE-2026-69240: sequelize 6.31.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-69240: sequelize 6.31.0 \u2014 package-lock.json"}, "fullDescription": {"text": "sequelize: Sequelize: SQL Injection via improper handling of Oracle date functions\n\nSequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacker can inject arbitrary SQL expressions through an application value that reaches this escape path. T\n\nPackage: sequelize\nInstalled: 6.31.0\nFixed in: 6.37.4\nSeverity: CRITICAL\nFix: Upgrade sequelize to 6.37.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-76d0feefa2c218ff", "name": "CVE-2026-30951: sequelize 6.31.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-30951: sequelize 6.31.0 \u2014 package-lock.json"}, "fullDescription": {"text": "sequelize: Sequelize: Data exfiltration via SQL injection in JSON/JSONB where clause processing\n\nSequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.\n\nPackage: sequelize\nInstalled: 6.31.0\nFixed in: 6.37.8\nSeverity: HIGH\nFix: Upgrade sequelize to 6.37.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-74773e7b700664f1", "name": "CVE-2024-43800: serve-static 1.15.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-43800: serve-static 1.15.0 \u2014 package-lock.json"}, "fullDescription": {"text": "serve-static: Improper Sanitization in serve-static\n\nserve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.\n\nPackage: serve-static\nInstalled: 1.15.0\nFixed in: 1.16.0, 2.1.0\nSeverity: LOW\nFix: Upgrade serve-static to 1.16.0, 2.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-591a9ee8c8c839c0", "name": "CVE-2024-38355: socket.io 4.6.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-38355: socket.io 4.6.1 \u2014 package-lock.json"}, "fullDescription": {"text": "socket.io: Unhandled 'error' event\n\nSocket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\n\nPackage: socket.io\nInstalled: 4.6.1\nFixed in: 2.5.1, 4.6.2\nSeverity: MEDIUM\nFix: Upgrade socket.io to 2.5.1, 4.6.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c8d2e9cb4f2ecc1", "name": "CVE-2026-33151: socket.io-parser 4.2.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33151: socket.io-parser 4.2.2 \u2014 package-lock.json"}, "fullDescription": {"text": "socket.io: Socket.IO: Denial of Service due to excessive buffering of specially crafted packets\n\nSocket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.\n\nPackage: socket.io-parser\nInstalled: 4.2.2\nFixed in: 3.3.5, 3.4.4, 4.2.6\nSeverity: HIGH\nFix: Upgrade socket.io-parser to 3.3.5, 3.4.4, 4.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a7919e3f1c818389", "name": "CVE-2026-69185: socket.io-parser 4.2.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-69185: socket.io-parser 4.2.2 \u2014 package-lock.json"}, "fullDescription": {"text": "socket.io-parser: Socket.IO: Denial of Service via memory exhaustion from crafted packets\n\nSocket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.\n\nPackage: socket.io-parser\nInstalled: 4.2.2\nFixed in: 4.2.7, 3.4.5, 3.3.6\nSeverity: HIGH\nFix: Upgrade socket.io-parser to 4.2.7, 3.4.5, 3.3.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cfe805a6ec328ed4", "name": "CVE-2023-32695: socket.io-parser 4.2.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-32695: socket.io-parser 4.2.2 \u2014 package-lock.json"}, "fullDescription": {"text": "socket.io parser is a socket.io encoder and decoder written in JavaScr ...\n\nsocket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.\n\nPackage: socket.io-parser\nInstalled: 4.2.2\nFixed in: 4.2.3, 3.4.3, 3.3.4\nSeverity: MEDIUM\nFix: Upgrade socket.io-parser to 4.2.3, 3.4.3, 3.3.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43e671add7c17f96", "name": "CVE-2026-59873: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59873: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "tar: node-tar: Denial of Service via crafted gzip bomb\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.19\nSeverity: CRITICAL\nFix: Upgrade tar to 7.5.19"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-053c6539aba51a80", "name": "CVE-2026-23745: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-23745: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives\n\nnode-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.3\nSeverity: HIGH\nFix: Upgrade tar to 7.5.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-01ef74fede9d0ef9", "name": "CVE-2026-23950: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-23950: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition\n\nnode-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `\u00df` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.4\nSeverity: HIGH\nFix: Upgrade tar to 7.5.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-afd6ae624c1186f1", "name": "CVE-2026-24842: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-24842: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check\n\nnode-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.7\nSeverity: HIGH\nFix: Upgrade tar to 7.5.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e64fc0b3363ab97f", "name": "CVE-2026-26960: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-26960: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation\n\nnode-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.8\nSeverity: HIGH\nFix: Upgrade tar to 7.5.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a69d4f8e442fb135", "name": "CVE-2026-29786: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-29786: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: hardlink path traversal via drive-relative linkpath\n\nnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.10\nSeverity: HIGH\nFix: Upgrade tar to 7.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-de3bf737074351fe", "name": "CVE-2026-31802: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-31802: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "tar: tar: File overwrite via drive-relative symlink traversal\n\nnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.11\nSeverity: HIGH\nFix: Upgrade tar to 7.5.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-24874044eac61749", "name": "CVE-2026-59874: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59874: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "tar: Node-tar: Denial of Service via malformed tar archive header\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.18\nSeverity: HIGH\nFix: Upgrade tar to 7.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-82f95adceb6838dd", "name": "CVE-2026-73566: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-73566: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "tar: node-tar: Denial of Service via crafted long-path tar archive\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxD\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.21\nSeverity: HIGH\nFix: Upgrade tar to 7.5.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-062547f4c2e3e3e6", "name": "CVE-2024-28863: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-28863: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: denial of service while parsing a tar file due to lack of folders depth validation\n\nnode-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 6.2.1\nSeverity: MEDIUM\nFix: Upgrade tar to 6.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a1879fad677e51b", "name": "CVE-2026-53655: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-53655: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: File smuggling due to inconsistent tar archive parsing\n\nnode-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the by\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.16\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-053125a2cddb78b2", "name": "CVE-2026-59871: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59871: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: Denial of Service due to incorrect PAX path handling\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.18\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8855c0ab3691e86", "name": "CVE-2026-59875: tar 6.1.13 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59875: tar 6.1.13 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.\n\nPackage: tar\nInstalled: 6.1.13\nFixed in: 7.5.17\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1fb15454391d0e2d", "name": "CVE-2023-26136: tough-cookie 2.5.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-26136: tough-cookie 2.5.0 \u2014 package-lock.json"}, "fullDescription": {"text": "tough-cookie: prototype pollution in cookie memstore\n\nVersions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.\n\nPackage: tough-cookie\nInstalled: 2.5.0\nFixed in: 4.1.3\nSeverity: MEDIUM\nFix: Upgrade tough-cookie to 4.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a49444de561c5107", "name": "CVE-2026-27601: underscore 1.13.6 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27601: underscore 1.13.6 \u2014 package-lock.json"}, "fullDescription": {"text": "Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions\n\nUnderscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow. Untrusted input must be used to create a recursive datastructure, for example using JSON.parse, with no enforced depth limit. The datastructure thus created must be passed to _.flatten or _.isEqual. In the\n\nPackage: underscore\nInstalled: 1.13.6\nFixed in: 1.13.8\nSeverity: HIGH\nFix: Upgrade underscore to 1.13.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-002a799a6b092d13", "name": "CVE-2026-12151: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-12151: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames\n\nImpact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: HIGH\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-190a59bed67cb755", "name": "CVE-2026-1526: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-1526: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression\n\nThe undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a \"decompression bomb\") that expands to an extremely large size in memory, causing the Node.js process to e\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 6.24.0, 7.24.0\nSeverity: HIGH\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-da17510701954f01", "name": "CVE-2026-2229: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-2229: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter\n\nImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the\u00a0server_max_window_bits\u00a0parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range\u00a0server_max_window_bits\u00a0value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to cre\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 6.24.0, 7.24.0\nSeverity: HIGH\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-61d438c03672d7a0", "name": "CVE-2025-22150: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-22150: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici Uses Insufficiently Random Values\n\nUndici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests \n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 5.28.5, 6.21.1, 7.2.3\nSeverity: MEDIUM\nFix: Upgrade undici to 5.28.5, 6.21.1, 7.2.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f0b1e810aa4fd60", "name": "CVE-2026-15157: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-15157: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: undici: HTTP header injection via unvalidated blob-like body type property\n\nundici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second r\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 6.28.0, 7.29.0, 8.9.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.28.0, 7.29.0, 8.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9421a0aa379bdcb", "name": "CVE-2026-1525: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-1525: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers\n\nUndici allows duplicate HTTP\u00a0Content-Length\u00a0headers when they are provided in an array with case-variant names (e.g.,\u00a0Content-Length\u00a0and\u00a0content-length). This produces malformed HTTP/1.1 requests with multiple conflicting\u00a0Content-Length\u00a0values on the wire.\n\nWho is impacted:\n\n  *  Applications using\u00a0undici.request(),\u00a0undici.Client, or similar low-level APIs with headers passed as flat arrays\n  *  Applications that accept user-controlled header names without case-normalization\n\n\nPotential conseque\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 6.24.0, 7.24.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2ccefce1dd565c7", "name": "CVE-2026-1527: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-1527: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: HTTP header injection and request smuggling vulnerability\n\nImpactWhen an application passes user-controlled input to the\u00a0upgrade\u00a0option of\u00a0client.request(), an attacker can inject CRLF sequences (\\r\\n) to:\n\n  *  Inject arbitrary HTTP headers\n  *  Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)\nThe vulnerability exists because undici writes the\u00a0upgrade\u00a0value directly to the socket without validating for invalid header characters:\n\n// lib/dispatcher/client-h1.js:1121\nif (upgrade) {\n  heade\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 6.24.0, 7.24.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.24.0, 7.24.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0a59752940db46c", "name": "CVE-2026-16728: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-16728: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length\n\nundici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length sta\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 6.28.0, 7.29.0, 8.9.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.28.0, 7.29.0, 8.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f33d9a3c04c8931", "name": "CVE-2026-16729: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-16729: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: Cookie attribute injection allows bypassing security protections\n\nundici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the call\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 6.28.0, 7.29.0, 8.9.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.28.0, 7.29.0, 8.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7368eef75449588", "name": "CVE-2026-22036: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-22036: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: Denial of Service via excessive decompression steps\n\nUndici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 7.18.2, 6.23.0\nSeverity: MEDIUM\nFix: Upgrade undici to 7.18.2, 6.23.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afdebcb2f092158b", "name": "CVE-2026-9679: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-9679: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding\n\nImpact:\nundici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 \u00a75.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inj\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: MEDIUM\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4936f3ccbedce54", "name": "CVE-2023-45143: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2023-45143: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "node-undici: cookie leakage\n\nUndici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this m\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 5.26.2\nSeverity: LOW\nFix: Upgrade undici to 5.26.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-013ca009d7190a81", "name": "CVE-2024-24758: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-24758: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: sensitive information exposure\n\nUndici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 5.28.3, 6.6.1\nSeverity: LOW\nFix: Upgrade undici to 5.28.3, 6.6.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-485ee74df32760d5", "name": "CVE-2024-30260: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-30260: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-undici: proxy-authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline\n\nUndici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 5.28.4, 6.11.1\nSeverity: LOW\nFix: Upgrade undici to 5.28.4, 6.11.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac83769f202fbdce", "name": "CVE-2024-30261: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-30261: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-undici: fetch() with integrity option is too lax when algorithm is specified but hash value is in incorrect\n\nUndici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 5.28.4, 6.11.1\nSeverity: LOW\nFix: Upgrade undici to 5.28.4, 6.11.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0a25472dd19f74a", "name": "CVE-2025-47279: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-47279: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici Memory Leak with Invalid Certificates\n\nUndici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 5.29.0, 6.21.2, 7.5.0\nSeverity: LOW\nFix: Upgrade undici to 5.29.0, 6.21.2, 7.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-838d9d1a05d5420d", "name": "CVE-2026-11525: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-11525: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n\nImpact:\nWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).\n\nAffected applications are those that consume Set-Cookie header\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: LOW\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e70fd30e837598d7", "name": "CVE-2026-6733: undici 5.25.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-6733: undici 5.25.2 \u2014 package-lock.json"}, "fullDescription": {"text": "undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.\n\nImpact:\nUndici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-ali\n\nPackage: undici\nInstalled: 5.25.2\nFixed in: 6.27.0, 7.28.0, 8.5.0\nSeverity: LOW\nFix: Upgrade undici to 6.27.0, 7.28.0, 8.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69408c2d566dfc6b", "name": "CVE-2026-41907: uuid 3.4.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-41907: uuid 3.4.0 \u2014 package-lock.json"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 3.4.0\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4739f516a66919b1", "name": "CVE-2026-41907: uuid 8.3.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-41907: uuid 8.3.2 \u2014 package-lock.json"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 8.3.2\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1ac7214f5835197", "name": "CVE-2025-12758: validator 13.9.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-12758: validator 13.9.0 \u2014 package-lock.json"}, "fullDescription": {"text": "Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements\n\nVersions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\\uFE0F, \\uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer over\n\nPackage: validator\nInstalled: 13.9.0\nFixed in: 13.15.22\nSeverity: HIGH\nFix: Upgrade validator to 13.15.22"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa8f585374f0d31b", "name": "CVE-2025-56200: validator 13.9.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-56200: validator 13.9.0 \u2014 package-lock.json"}, "fullDescription": {"text": "validator.js has a URL validation bypass vulnerability in its isURL function\n\nA URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.\n\nPackage: validator\nInstalled: 13.9.0\nFixed in: 13.15.20\nSeverity: MEDIUM\nFix: Upgrade validator to 13.15.20"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84bd70cad5df019f", "name": "CVE-2024-37890: ws 3.3.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-37890: ws 3.3.3 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-ws: denial of service when handling a request with many HTTP headers\n\nws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or th\n\nPackage: ws\nInstalled: 3.3.3\nFixed in: 5.2.4, 6.2.3, 7.5.10, 8.17.1\nSeverity: HIGH\nFix: Upgrade ws to 5.2.4, 6.2.3, 7.5.10, 8.17.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f4d21334e5163f58", "name": "CVE-2026-48779: ws 3.3.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 3.3.3 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 3.3.3\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-16b8342bb7d78b20", "name": "CVE-2024-37890: ws 7.5.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-37890: ws 7.5.9 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-ws: denial of service when handling a request with many HTTP headers\n\nws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or th\n\nPackage: ws\nInstalled: 7.5.9\nFixed in: 5.2.4, 6.2.3, 7.5.10, 8.17.1\nSeverity: HIGH\nFix: Upgrade ws to 5.2.4, 6.2.3, 7.5.10, 8.17.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bad528e6ad0b27f0", "name": "CVE-2026-48779: ws 7.5.9 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 7.5.9 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 7.5.9\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eedb848ae31df6ce", "name": "CVE-2024-37890: ws 8.11.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-37890: ws 8.11.0 \u2014 package-lock.json"}, "fullDescription": {"text": "nodejs-ws: denial of service when handling a request with many HTTP headers\n\nws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or th\n\nPackage: ws\nInstalled: 8.11.0\nFixed in: 5.2.4, 6.2.3, 7.5.10, 8.17.1\nSeverity: HIGH\nFix: Upgrade ws to 5.2.4, 6.2.3, 7.5.10, 8.17.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-332ab96967dd5e06", "name": "CVE-2026-48779: ws 8.11.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 8.11.0 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.11.0\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ec755e3947680196", "name": "CVE-2026-45736: ws 8.11.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-45736: ws 8.11.0 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.11.0\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc79fd8953c6e35d", "name": "Insecure pattern 'node_child_process' in Goat.js:27", "shortDescription": {"text": "Insecure pattern 'node_child_process' in Goat.js:27"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-ea5b86173718ea3a", "name": "Insecure pattern 'node_child_process' in index.js:20", "shortDescription": {"text": "Insecure pattern 'node_child_process' in index.js:20"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-60afbf3fcf4b744b", "name": "Insecure pattern 'eval_used' in update.js:4", "shortDescription": {"text": "Insecure pattern 'eval_used' in update.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3b605d13c341512b", "name": "Insecure pattern 'eval_used' in bot/login/loginMbasic.js:1", "shortDescription": {"text": "Insecure pattern 'eval_used' in bot/login/loginMbasic.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ce4390c82e527adf", "name": "Possible secret in scripts/cmds/weather.js", "shortDescription": {"text": "Possible secret in scripts/cmds/weather.js"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.72}}, {"id": "scanner-613a7568616d29b2", "name": "Insecure pattern 'eval_used' in scripts/cmds/eval.js:72", "shortDescription": {"text": "Insecure pattern 'eval_used' in scripts/cmds/eval.js:72"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3bbcd5c227c28eb4", "name": "Insecure pattern 'node_child_process' in scripts/cmds/cmd.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/cmds/cmd.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-34d23473aec2b2f8", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/preview-modal.js:4", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/preview-modal.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-c35a52bca573c9ab", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/toast.js:43", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/toast.js:43"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-450e3ea33203faa8", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/bootstrap.bundle.min.js:3049", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/bootstrap.bundle.min.js:3049"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-c7bb71df81fed2f0", "name": "Insecure pattern 'domparser_html_parse' in dashboard/js/bootstrap.bundle.min.js:3078", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in dashboard/js/bootstrap.bundle.min.js:3078"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-ccb40916078d3b37", "name": "Very large file: dashboard/js/phoenix.js (4956 lines)", "shortDescription": {"text": "Very large file: dashboard/js/phoenix.js (4956 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbc839136c32b937", "name": "Very large file: dashboard/js/bootstrap.bundle.min.js (3965 lines)", "shortDescription": {"text": "Very large file: dashboard/js/bootstrap.bundle.min.js (3965 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 195 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 42 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c9cb2c1ecc7d978", "name": "Commented-code block (5 lines) in bot/login/login.js:988", "shortDescription": {"text": "Commented-code block (5 lines) in bot/login/login.js:988"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-a0ad6f582bfd4ba2", "name": "Commented-code block (6 lines) in scripts/cmds/ytb.js:269", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/cmds/ytb.js:269"}, "fullDescription": {"text": "4 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-2757c49ada0f8d90", "name": "Commented-code block (6 lines) in dashboard/routes/api.js:344", "shortDescription": {"text": "Commented-code block (6 lines) in dashboard/routes/api.js:344"}, "fullDescription": {"text": "3 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-cf6303d0149baa9a", "name": "Commented-code block (6 lines) in fb-chat-api/utils.js:1127", "shortDescription": {"text": "Commented-code block (6 lines) in fb-chat-api/utils.js:1127"}, "fullDescription": {"text": "5 of 6 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-6b3dcdb23b4c0c18", "name": "Legacy-named symbol `jewel_requests_remove_old` in fb-chat-api/src/listenMqtt.js:200", "shortDescription": {"text": "Legacy-named symbol `jewel_requests_remove_old` in fb-chat-api/src/listenMqtt.js:200"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a4af9d8ffc71abb", "name": "Commented-code block (12 lines) in fb-chat-api/src/listenMqtt.js:753", "shortDescription": {"text": "Commented-code block (12 lines) in fb-chat-api/src/listenMqtt.js:753"}, "fullDescription": {"text": "8 of 12 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-9554c34a61fcb264", "name": "Vulnerable dependency axios 0.21.4: GHSA-3g43-6gmg-66jw", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-3g43-6gmg-66jw"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-3g43-6gmg-66jw (aka CVE-2026-44495).\n\naxios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge\n\nAliases: CVE-2026-44495\nAdvisory: https://osv.dev/vulnerability/GHSA-3g43-6gmg-66jw\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-8f57b08dbe2e62da", "name": "Vulnerable dependency axios 0.21.4: GHSA-3p68-rc4w-qgx5", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-3p68-rc4w-qgx5"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-3p68-rc4w-qgx5 (aka CVE-2025-62718).\n\nAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF\n\nAliases: CVE-2025-62718\nAdvisory: https://osv.dev/vulnerability/GHSA-3p68-rc4w-qgx5\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a2d79c74a7d8cdb1", "name": "Vulnerable dependency axios 0.21.4: GHSA-43fc-jf86-j433", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-43fc-jf86-j433"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-43fc-jf86-j433 (aka CVE-2026-25639).\n\nAxios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig\n\nAliases: CVE-2026-25639\nAdvisory: https://osv.dev/vulnerability/GHSA-43fc-jf86-j433\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c00bbabb4e620fc8", "name": "Vulnerable dependency axios 0.21.4: GHSA-5c9x-8gcm-mpgx", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-5c9x-8gcm-mpgx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-5c9x-8gcm-mpgx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5c9x-8gcm-mpgx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6f24505be1f3fbdb", "name": "Vulnerable dependency axios 0.21.4: GHSA-62hf-57xw-28j9", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-62hf-57xw-28j9"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-62hf-57xw-28j9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-62hf-57xw-28j9\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ce4a060cd875bcc8", "name": "Vulnerable dependency axios 0.21.4: GHSA-6chq-wfr3-2hj9", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-6chq-wfr3-2hj9"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-6chq-wfr3-2hj9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6chq-wfr3-2hj9\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-67699ceea4353071", "name": "Vulnerable dependency axios 0.21.4: GHSA-7q8q-rj6j-mhjq", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-7q8q-rj6j-mhjq"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-7q8q-rj6j-mhjq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7q8q-rj6j-mhjq\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-0e36062f31ad7c38", "name": "Vulnerable dependency axios 0.21.4: GHSA-898c-q2cr-xwhg", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-898c-q2cr-xwhg"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-898c-q2cr-xwhg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-898c-q2cr-xwhg\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-20a326d40367bdc4", "name": "Vulnerable dependency axios 0.21.4: GHSA-fvcv-3m26-pcqx", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-fvcv-3m26-pcqx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-fvcv-3m26-pcqx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fvcv-3m26-pcqx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3859ebc824631787", "name": "Vulnerable dependency axios 0.21.4: GHSA-hfxv-24rg-xrqf", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-hfxv-24rg-xrqf"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-hfxv-24rg-xrqf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hfxv-24rg-xrqf\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6ccb5ea8a6ba5f57", "name": "Vulnerable dependency axios 0.21.4: GHSA-j5f8-grm9-p9fc", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-j5f8-grm9-p9fc"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-j5f8-grm9-p9fc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j5f8-grm9-p9fc\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a8903888e2838f9a", "name": "Vulnerable dependency axios 0.21.4: GHSA-jr5f-v2jv-69x6", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-jr5f-v2jv-69x6"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-jr5f-v2jv-69x6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jr5f-v2jv-69x6\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8367d7a4e1586b11", "name": "Vulnerable dependency axios 0.21.4: GHSA-m7pr-hjqh-92cm", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-m7pr-hjqh-92cm"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-m7pr-hjqh-92cm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m7pr-hjqh-92cm\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8f071312cd8b9ea4", "name": "Vulnerable dependency axios 0.21.4: GHSA-mmx7-hfxf-jppx", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-mmx7-hfxf-jppx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-mmx7-hfxf-jppx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mmx7-hfxf-jppx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6dea7b1d802d614d", "name": "Vulnerable dependency axios 0.21.4: GHSA-p92q-9vqr-4j8v", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-p92q-9vqr-4j8v"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-p92q-9vqr-4j8v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p92q-9vqr-4j8v\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-969b9bd2b2dce504", "name": "Vulnerable dependency axios 0.21.4: GHSA-pf86-5x62-jrwf", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-pf86-5x62-jrwf"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-pf86-5x62-jrwf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pf86-5x62-jrwf\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4224eb960b4131e7", "name": "Vulnerable dependency axios 0.21.4: GHSA-pjwm-pj3p-43mv", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-pjwm-pj3p-43mv"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-pjwm-pj3p-43mv.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pjwm-pj3p-43mv\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4c263302b073a59f", "name": "Vulnerable dependency axios 0.21.4: GHSA-pmwg-cvhr-8vh7", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-pmwg-cvhr-8vh7"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-pmwg-cvhr-8vh7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pmwg-cvhr-8vh7\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c2b95ee2f96eb781", "name": "Vulnerable dependency axios 0.21.4: GHSA-vf2m-468p-8v99", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-vf2m-468p-8v99"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-vf2m-468p-8v99.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vf2m-468p-8v99\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8ad854b7f62f8902", "name": "Vulnerable dependency axios 0.21.4: GHSA-w9j2-pvgh-6h63", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-w9j2-pvgh-6h63"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-w9j2-pvgh-6h63.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w9j2-pvgh-6h63\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e79f4d85166e9ecd", "name": "Vulnerable dependency axios 0.21.4: GHSA-wf5p-g6vw-rhxx", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-wf5p-g6vw-rhxx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-wf5p-g6vw-rhxx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wf5p-g6vw-rhxx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5c943281731d4287", "name": "Vulnerable dependency axios 0.21.4: GHSA-xhjh-pmcv-23jw", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-xhjh-pmcv-23jw"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-xhjh-pmcv-23jw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xhjh-pmcv-23jw\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2269d9a59a660ecc", "name": "Vulnerable dependency axios 0.21.4: GHSA-xx6v-rp6x-q39c", "shortDescription": {"text": "Vulnerable dependency axios 0.21.4: GHSA-xx6v-rp6x-q39c"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-xx6v-rp6x-q39c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xx6v-rp6x-q39c\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-405353e94f2520a7", "name": "Vulnerable dependency axios 1.4.0: GHSA-35jp-ww65-95wh", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-35jp-ww65-95wh"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-35jp-ww65-95wh.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-35jp-ww65-95wh\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d7bac8b28408d093", "name": "Vulnerable dependency axios 1.4.0: GHSA-3g43-6gmg-66jw", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-3g43-6gmg-66jw"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-3g43-6gmg-66jw (aka CVE-2026-44495).\n\naxios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge\n\nAliases: CVE-2026-44495\nAdvisory: https://osv.dev/vulnerability/GHSA-3g43-6gmg-66jw\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-94c4c7fa5a8f6033", "name": "Vulnerable dependency axios 1.4.0: GHSA-3p68-rc4w-qgx5", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-3p68-rc4w-qgx5"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-3p68-rc4w-qgx5 (aka CVE-2025-62718).\n\nAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF\n\nAliases: CVE-2025-62718\nAdvisory: https://osv.dev/vulnerability/GHSA-3p68-rc4w-qgx5\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f118b5be6f416a7", "name": "Vulnerable dependency axios 1.4.0: GHSA-3w6x-2g7m-8v23", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-3w6x-2g7m-8v23"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-3w6x-2g7m-8v23.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3w6x-2g7m-8v23\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21cf1a60579ddae5", "name": "Vulnerable dependency axios 1.4.0: GHSA-42h9-826w-cgv3", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-42h9-826w-cgv3"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-42h9-826w-cgv3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-42h9-826w-cgv3\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbac9f97b18fa7d6", "name": "Vulnerable dependency axios 1.4.0: GHSA-43fc-jf86-j433", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-43fc-jf86-j433"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-43fc-jf86-j433 (aka CVE-2026-25639).\n\nAxios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig\n\nAliases: CVE-2026-25639\nAdvisory: https://osv.dev/vulnerability/GHSA-43fc-jf86-j433\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-206d37a21d3b1c9e", "name": "Vulnerable dependency axios 1.4.0: GHSA-445q-vr5w-6q77", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-445q-vr5w-6q77"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-445q-vr5w-6q77.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-445q-vr5w-6q77\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-12288acdfa3464bf", "name": "Vulnerable dependency axios 1.4.0: GHSA-4hjh-wcwx-xvwj", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-4hjh-wcwx-xvwj"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-4hjh-wcwx-xvwj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4hjh-wcwx-xvwj\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14364ebbd0d3bd49", "name": "Vulnerable dependency axios 1.4.0: GHSA-5c9x-8gcm-mpgx", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-5c9x-8gcm-mpgx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-5c9x-8gcm-mpgx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5c9x-8gcm-mpgx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7cc1e95bb4f29406", "name": "Vulnerable dependency axios 1.4.0: GHSA-62hf-57xw-28j9", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-62hf-57xw-28j9"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-62hf-57xw-28j9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-62hf-57xw-28j9\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df56d39a28c64f33", "name": "Vulnerable dependency axios 1.4.0: GHSA-6chq-wfr3-2hj9", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-6chq-wfr3-2hj9"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-6chq-wfr3-2hj9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6chq-wfr3-2hj9\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-baf02b0bb8366924", "name": "Vulnerable dependency axios 1.4.0: GHSA-7q8q-rj6j-mhjq", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-7q8q-rj6j-mhjq"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-7q8q-rj6j-mhjq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7q8q-rj6j-mhjq\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ee66d914310429c", "name": "Vulnerable dependency axios 1.4.0: GHSA-898c-q2cr-xwhg", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-898c-q2cr-xwhg"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-898c-q2cr-xwhg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-898c-q2cr-xwhg\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58d87c9e9172d2f9", "name": "Vulnerable dependency axios 1.4.0: GHSA-8hc4-vh64-cxmj", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-8hc4-vh64-cxmj"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-8hc4-vh64-cxmj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8hc4-vh64-cxmj\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0e22f3286f65194", "name": "Vulnerable dependency axios 1.4.0: GHSA-fvcv-3m26-pcqx", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-fvcv-3m26-pcqx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-fvcv-3m26-pcqx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fvcv-3m26-pcqx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-384056bb6124e22f", "name": "Vulnerable dependency axios 1.4.0: GHSA-hfxv-24rg-xrqf", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-hfxv-24rg-xrqf"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-hfxv-24rg-xrqf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hfxv-24rg-xrqf\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9df9ede97a54a8d", "name": "Vulnerable dependency axios 1.4.0: GHSA-j5f8-grm9-p9fc", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-j5f8-grm9-p9fc"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-j5f8-grm9-p9fc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j5f8-grm9-p9fc\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a832ca1fe29f6b19", "name": "Vulnerable dependency axios 1.4.0: GHSA-jr5f-v2jv-69x6", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-jr5f-v2jv-69x6"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-jr5f-v2jv-69x6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jr5f-v2jv-69x6\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-932ba10a7ff362bf", "name": "Vulnerable dependency axios 1.4.0: GHSA-m7pr-hjqh-92cm", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-m7pr-hjqh-92cm"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-m7pr-hjqh-92cm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m7pr-hjqh-92cm\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93ede8c7c8cdb53d", "name": "Vulnerable dependency axios 1.4.0: GHSA-mmx7-hfxf-jppx", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-mmx7-hfxf-jppx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-mmx7-hfxf-jppx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mmx7-hfxf-jppx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-22ffa70365ae1da3", "name": "Vulnerable dependency axios 1.4.0: GHSA-p92q-9vqr-4j8v", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-p92q-9vqr-4j8v"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-p92q-9vqr-4j8v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p92q-9vqr-4j8v\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb048a0c318b79eb", "name": "Vulnerable dependency axios 1.4.0: GHSA-pf86-5x62-jrwf", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-pf86-5x62-jrwf"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-pf86-5x62-jrwf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pf86-5x62-jrwf\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f1493c190d69b6f", "name": "Vulnerable dependency axios 1.4.0: GHSA-pmv8-rq9r-6j72", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-pmv8-rq9r-6j72"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-pmv8-rq9r-6j72.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pmv8-rq9r-6j72\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17bbd6174410d007", "name": "Vulnerable dependency axios 1.4.0: GHSA-pmwg-cvhr-8vh7", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-pmwg-cvhr-8vh7"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-pmwg-cvhr-8vh7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pmwg-cvhr-8vh7\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d516a0366a3360bc", "name": "Vulnerable dependency axios 1.4.0: GHSA-q8qp-cvcw-x6jj", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-q8qp-cvcw-x6jj"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-q8qp-cvcw-x6jj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q8qp-cvcw-x6jj\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-033867c335f1e0d0", "name": "Vulnerable dependency axios 1.4.0: GHSA-vf2m-468p-8v99", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-vf2m-468p-8v99"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-vf2m-468p-8v99.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vf2m-468p-8v99\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9bb8c5e446989264", "name": "Vulnerable dependency axios 1.4.0: GHSA-w9j2-pvgh-6h63", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-w9j2-pvgh-6h63"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-w9j2-pvgh-6h63.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w9j2-pvgh-6h63\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8444573eb9d5a6f3", "name": "Vulnerable dependency axios 1.4.0: GHSA-wf5p-g6vw-rhxx", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-wf5p-g6vw-rhxx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-wf5p-g6vw-rhxx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wf5p-g6vw-rhxx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc86a42eba0753fe", "name": "Vulnerable dependency axios 1.4.0: GHSA-xhjh-pmcv-23jw", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-xhjh-pmcv-23jw"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-xhjh-pmcv-23jw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xhjh-pmcv-23jw\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-573a612daeefb8a1", "name": "Vulnerable dependency axios 1.4.0: GHSA-xx6v-rp6x-q39c", "shortDescription": {"text": "Vulnerable dependency axios 1.4.0: GHSA-xx6v-rp6x-q39c"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-xx6v-rp6x-q39c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xx6v-rp6x-q39c\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38b49ee09735f994", "name": "Vulnerable dependency qs 6.11.0: GHSA-4mjr-xmp4-gh2g", "shortDescription": {"text": "Vulnerable dependency qs 6.11.0: GHSA-4mjr-xmp4-gh2g"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.11.0` (resolved in `package-lock.json`) is affected by GHSA-4mjr-xmp4-gh2g (aka CVE-2026-82417).\n\nqs: Denial of Service via Attacker Controlled isBuffer\n\nAliases: CVE-2026-82417\nAdvisory: https://osv.dev/vulnerability/GHSA-4mjr-xmp4-gh2g\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d255c092d51fd80", "name": "Vulnerable dependency qs 6.11.0: GHSA-6rw7-vpxm-498p", "shortDescription": {"text": "Vulnerable dependency qs 6.11.0: GHSA-6rw7-vpxm-498p"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.11.0` (resolved in `package-lock.json`) is affected by GHSA-6rw7-vpxm-498p (aka CVE-2025-15284).\n\nqs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion\n\nAliases: CVE-2025-15284\nAdvisory: https://osv.dev/vulnerability/GHSA-6rw7-vpxm-498p\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f3e9fa879d9618b", "name": "Vulnerable dependency qs 6.11.0: GHSA-w7fw-mjwx-w883", "shortDescription": {"text": "Vulnerable dependency qs 6.11.0: GHSA-w7fw-mjwx-w883"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.11.0` (resolved in `package-lock.json`) is affected by GHSA-w7fw-mjwx-w883.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w7fw-mjwx-w883\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd3b18c468a2fa1e", "name": "Vulnerable dependency eta 1.12.3: GHSA-mf6x-hrgr-658f", "shortDescription": {"text": "Vulnerable dependency eta 1.12.3: GHSA-mf6x-hrgr-658f"}, "fullDescription": {"text": "OSV.dev reports `eta` at version `1.12.3` (resolved in `package-lock.json`) is affected by GHSA-mf6x-hrgr-658f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mf6x-hrgr-658f\nFix: upgrade `eta` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a591c7cc9aee6440", "name": "Vulnerable dependency eta 1.12.3: GHSA-xrh7-m5pp-39r6", "shortDescription": {"text": "Vulnerable dependency eta 1.12.3: GHSA-xrh7-m5pp-39r6"}, "fullDescription": {"text": "OSV.dev reports `eta` at version `1.12.3` (resolved in `package-lock.json`) is affected by GHSA-xrh7-m5pp-39r6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xrh7-m5pp-39r6\nFix: upgrade `eta` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39d710c4d56d5add", "name": "Vulnerable dependency express 4.18.2: GHSA-qw6h-vgh9-j6wx", "shortDescription": {"text": "Vulnerable dependency express 4.18.2: GHSA-qw6h-vgh9-j6wx"}, "fullDescription": {"text": "OSV.dev reports `express` at version `4.18.2` (resolved in `package-lock.json`) is affected by GHSA-qw6h-vgh9-j6wx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qw6h-vgh9-j6wx\nFix: upgrade `express` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87c927c4198b7027", "name": "Vulnerable dependency express 4.18.2: GHSA-rv95-896h-c2vc", "shortDescription": {"text": "Vulnerable dependency express 4.18.2: GHSA-rv95-896h-c2vc"}, "fullDescription": {"text": "OSV.dev reports `express` at version `4.18.2` (resolved in `package-lock.json`) is affected by GHSA-rv95-896h-c2vc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rv95-896h-c2vc\nFix: upgrade `express` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4869f69b341a430", "name": "Vulnerable dependency form-data 4.0.0: GHSA-fjxv-7rqg-78g4", "shortDescription": {"text": "Vulnerable dependency form-data 4.0.0: GHSA-fjxv-7rqg-78g4"}, "fullDescription": {"text": "OSV.dev reports `form-data` at version `4.0.0` (resolved in `package-lock.json`) is affected by GHSA-fjxv-7rqg-78g4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fjxv-7rqg-78g4\nFix: upgrade `form-data` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f30e3601f0227298", "name": "Vulnerable dependency form-data 4.0.0: GHSA-hmw2-7cc7-3qxx", "shortDescription": {"text": "Vulnerable dependency form-data 4.0.0: GHSA-hmw2-7cc7-3qxx"}, "fullDescription": {"text": "OSV.dev reports `form-data` at version `4.0.0` (resolved in `package-lock.json`) is affected by GHSA-hmw2-7cc7-3qxx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hmw2-7cc7-3qxx\nFix: upgrade `form-data` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1fd01aafb9e7484a", "name": "Vulnerable dependency mongoose 6.10.5: GHSA-664h-wqgq-64gw", "shortDescription": {"text": "Vulnerable dependency mongoose 6.10.5: GHSA-664h-wqgq-64gw"}, "fullDescription": {"text": "OSV.dev reports `mongoose` at version `6.10.5` (resolved in `package-lock.json`) is affected by GHSA-664h-wqgq-64gw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-664h-wqgq-64gw\nFix: upgrade `mongoose` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c56e9052a05ff2e", "name": "Vulnerable dependency mongoose 6.10.5: GHSA-9m93-w8w6-76hh", "shortDescription": {"text": "Vulnerable dependency mongoose 6.10.5: GHSA-9m93-w8w6-76hh"}, "fullDescription": {"text": "OSV.dev reports `mongoose` at version `6.10.5` (resolved in `package-lock.json`) is affected by GHSA-9m93-w8w6-76hh.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9m93-w8w6-76hh\nFix: upgrade `mongoose` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c3f0d0b14a31554", "name": "Vulnerable dependency mongoose 6.10.5: GHSA-m7xq-9374-9rvx", "shortDescription": {"text": "Vulnerable dependency mongoose 6.10.5: GHSA-m7xq-9374-9rvx"}, "fullDescription": {"text": "OSV.dev reports `mongoose` at version `6.10.5` (resolved in `package-lock.json`) is affected by GHSA-m7xq-9374-9rvx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m7xq-9374-9rvx\nFix: upgrade `mongoose` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5577b1c4239b9bf", "name": "Vulnerable dependency mongoose 6.10.5: GHSA-vg7j-7cwx-8wgw", "shortDescription": {"text": "Vulnerable dependency mongoose 6.10.5: GHSA-vg7j-7cwx-8wgw"}, "fullDescription": {"text": "OSV.dev reports `mongoose` at version `6.10.5` (resolved in `package-lock.json`) is affected by GHSA-vg7j-7cwx-8wgw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vg7j-7cwx-8wgw\nFix: upgrade `mongoose` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b9076f00d41bad8", "name": "Vulnerable dependency mongoose 6.10.5: GHSA-wpg9-53fq-2r8h", "shortDescription": {"text": "Vulnerable dependency mongoose 6.10.5: GHSA-wpg9-53fq-2r8h"}, "fullDescription": {"text": "OSV.dev reports `mongoose` at version `6.10.5` (resolved in `package-lock.json`) is affected by GHSA-wpg9-53fq-2r8h.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wpg9-53fq-2r8h\nFix: upgrade `mongoose` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b04592f6fa99a6cc", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-268h-hp4c-crq3", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-268h-hp4c-crq3"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-268h-hp4c-crq3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-268h-hp4c-crq3\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83e4aa040c7aad6c", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-2x7j-588g-ccc2", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-2x7j-588g-ccc2"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-2x7j-588g-ccc2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2x7j-588g-ccc2\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35ba5b03c1155f86", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-8m3c-c648-2xjj", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-8m3c-c648-2xjj"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-8m3c-c648-2xjj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8m3c-c648-2xjj\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98045faadb659cc5", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-9h6g-pr28-7cqp", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-9h6g-pr28-7cqp"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-9h6g-pr28-7cqp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9h6g-pr28-7cqp\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c9a96d539b7b25a", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-c7w3-x93f-qmm8", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-c7w3-x93f-qmm8"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-c7w3-x93f-qmm8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-c7w3-x93f-qmm8\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dfddde07a8392b3e", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-mm7p-fcc7-pg87", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-mm7p-fcc7-pg87"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-mm7p-fcc7-pg87.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mm7p-fcc7-pg87\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d77a5186669c4d74", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-p6gq-j5cr-w38f", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-p6gq-j5cr-w38f"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-p6gq-j5cr-w38f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p6gq-j5cr-w38f\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f95b4f16619d9b9", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-r7g4-qg5f-qqm2", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-r7g4-qg5f-qqm2"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-r7g4-qg5f-qqm2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r7g4-qg5f-qqm2\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1fec71dab88340bc", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-rcmh-qjqh-p98v", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-rcmh-qjqh-p98v"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-rcmh-qjqh-p98v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rcmh-qjqh-p98v\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d28b8cd898a587c3", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-vvjj-xcjg-gr5g", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-vvjj-xcjg-gr5g"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-vvjj-xcjg-gr5g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vvjj-xcjg-gr5g\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8098c57a1e14199a", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-wmmp-3585-3rmp", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-wmmp-3585-3rmp"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-wmmp-3585-3rmp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wmmp-3585-3rmp\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f75533911536e66", "name": "Vulnerable dependency nodemailer 6.9.1: GHSA-wqvq-jvpq-h66f", "shortDescription": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-wqvq-jvpq-h66f"}, "fullDescription": {"text": "OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-wqvq-jvpq-h66f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wqvq-jvpq-h66f\nFix: upgrade `nodemailer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00ddf4f9ae31c007", "name": "Vulnerable dependency pm2 5.3.0: GHSA-x5gf-qvw8-r2rm", "shortDescription": {"text": "Vulnerable dependency pm2 5.3.0: GHSA-x5gf-qvw8-r2rm"}, "fullDescription": {"text": "OSV.dev reports `pm2` at version `5.3.0` (resolved in `package-lock.json`) is affected by GHSA-x5gf-qvw8-r2rm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x5gf-qvw8-r2rm\nFix: upgrade `pm2` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8dde0900ad910280", "name": "Vulnerable dependency qs 6.11.1: GHSA-4mjr-xmp4-gh2g", "shortDescription": {"text": "Vulnerable dependency qs 6.11.1: GHSA-4mjr-xmp4-gh2g"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.11.1` (resolved in `package-lock.json`) is affected by GHSA-4mjr-xmp4-gh2g (aka CVE-2026-82417).\n\nqs: Denial of Service via Attacker Controlled isBuffer\n\nAliases: CVE-2026-82417\nAdvisory: https://osv.dev/vulnerability/GHSA-4mjr-xmp4-gh2g\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-960cb74272eabbab", "name": "Vulnerable dependency qs 6.11.1: GHSA-6rw7-vpxm-498p", "shortDescription": {"text": "Vulnerable dependency qs 6.11.1: GHSA-6rw7-vpxm-498p"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.11.1` (resolved in `package-lock.json`) is affected by GHSA-6rw7-vpxm-498p (aka CVE-2025-15284).\n\nqs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion\n\nAliases: CVE-2025-15284\nAdvisory: https://osv.dev/vulnerability/GHSA-6rw7-vpxm-498p\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8647a404b227439", "name": "Vulnerable dependency qs 6.11.1: GHSA-q8mj-m7cp-5q26", "shortDescription": {"text": "Vulnerable dependency qs 6.11.1: GHSA-q8mj-m7cp-5q26"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.11.1` (resolved in `package-lock.json`) is affected by GHSA-q8mj-m7cp-5q26.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q8mj-m7cp-5q26\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b82b3872406cffcb", "name": "Vulnerable dependency qs 6.11.1: GHSA-w7fw-mjwx-w883", "shortDescription": {"text": "Vulnerable dependency qs 6.11.1: GHSA-w7fw-mjwx-w883"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.11.1` (resolved in `package-lock.json`) is affected by GHSA-w7fw-mjwx-w883.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w7fw-mjwx-w883\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ebdf15169d9c4bba", "name": "Vulnerable dependency request 2.88.2: GHSA-p8p7-x288-28g6", "shortDescription": {"text": "Vulnerable dependency request 2.88.2: GHSA-p8p7-x288-28g6"}, "fullDescription": {"text": "OSV.dev reports `request` at version `2.88.2` (resolved in `package-lock.json`) is affected by GHSA-p8p7-x288-28g6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p8p7-x288-28g6\nFix: upgrade `request` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-904de9b7ceb0ebde", "name": "Vulnerable dependency form-data 2.3.3: GHSA-fjxv-7rqg-78g4", "shortDescription": {"text": "Vulnerable dependency form-data 2.3.3: GHSA-fjxv-7rqg-78g4"}, "fullDescription": {"text": "OSV.dev reports `form-data` at version `2.3.3` (resolved in `package-lock.json`) is affected by GHSA-fjxv-7rqg-78g4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fjxv-7rqg-78g4\nFix: upgrade `form-data` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dddf616f81c2a473", "name": "Vulnerable dependency form-data 2.3.3: GHSA-hmw2-7cc7-3qxx", "shortDescription": {"text": "Vulnerable dependency form-data 2.3.3: GHSA-hmw2-7cc7-3qxx"}, "fullDescription": {"text": "OSV.dev reports `form-data` at version `2.3.3` (resolved in `package-lock.json`) is affected by GHSA-hmw2-7cc7-3qxx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hmw2-7cc7-3qxx\nFix: upgrade `form-data` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce0be11d6b7aff0c", "name": "Vulnerable dependency qs 6.5.3: GHSA-4mjr-xmp4-gh2g", "shortDescription": {"text": "Vulnerable dependency qs 6.5.3: GHSA-4mjr-xmp4-gh2g"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.5.3` (resolved in `package-lock.json`) is affected by GHSA-4mjr-xmp4-gh2g (aka CVE-2026-82417).\n\nqs: Denial of Service via Attacker Controlled isBuffer\n\nAliases: CVE-2026-82417\nAdvisory: https://osv.dev/vulnerability/GHSA-4mjr-xmp4-gh2g\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-058c00bf9ae58875", "name": "Vulnerable dependency qs 6.5.3: GHSA-6rw7-vpxm-498p", "shortDescription": {"text": "Vulnerable dependency qs 6.5.3: GHSA-6rw7-vpxm-498p"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.5.3` (resolved in `package-lock.json`) is affected by GHSA-6rw7-vpxm-498p (aka CVE-2025-15284).\n\nqs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion\n\nAliases: CVE-2025-15284\nAdvisory: https://osv.dev/vulnerability/GHSA-6rw7-vpxm-498p\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e48a2c1b496ecde6", "name": "Vulnerable dependency sequelize 6.31.0: GHSA-6457-6jrx-69cr", "shortDescription": {"text": "Vulnerable dependency sequelize 6.31.0: GHSA-6457-6jrx-69cr"}, "fullDescription": {"text": "OSV.dev reports `sequelize` at version `6.31.0` (resolved in `package-lock.json`) is affected by GHSA-6457-6jrx-69cr.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6457-6jrx-69cr\nFix: upgrade `sequelize` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a3934d7dae91f9b", "name": "Vulnerable dependency sequelize 6.31.0: GHSA-v8fg-2rw7-q452", "shortDescription": {"text": "Vulnerable dependency sequelize 6.31.0: GHSA-v8fg-2rw7-q452"}, "fullDescription": {"text": "OSV.dev reports `sequelize` at version `6.31.0` (resolved in `package-lock.json`) is affected by GHSA-v8fg-2rw7-q452.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v8fg-2rw7-q452\nFix: upgrade `sequelize` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d17e0bb231af160", "name": "Vulnerable dependency socket.io 4.6.1: GHSA-25hc-qcg6-38wj", "shortDescription": {"text": "Vulnerable dependency socket.io 4.6.1: GHSA-25hc-qcg6-38wj"}, "fullDescription": {"text": "OSV.dev reports `socket.io` at version `4.6.1` (resolved in `package-lock.json`) is affected by GHSA-25hc-qcg6-38wj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-25hc-qcg6-38wj\nFix: upgrade `socket.io` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d77988d1eac26d9", "name": "Vulnerable dependency @babel/runtime 7.21.0: GHSA-968p-4wvh-cqc8", "shortDescription": {"text": "Vulnerable dependency @babel/runtime 7.21.0: GHSA-968p-4wvh-cqc8"}, "fullDescription": {"text": "OSV.dev reports `@babel/runtime` at version `7.21.0` (resolved in `package-lock.json`) is affected by GHSA-968p-4wvh-cqc8.\nNote: `@babel/runtime` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-968p-4wvh-cqc8\nFix: upgrade `@babel/runtime` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c10381a92f56358f", "name": "Vulnerable dependency @babel/traverse 7.21.4: GHSA-67hx-6x53-jw92", "shortDescription": {"text": "Vulnerable dependency @babel/traverse 7.21.4: GHSA-67hx-6x53-jw92"}, "fullDescription": {"text": "OSV.dev reports `@babel/traverse` at version `7.21.4` (resolved in `package-lock.json`) is affected by GHSA-67hx-6x53-jw92.\nNote: `@babel/traverse` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-67hx-6x53-jw92\nFix: upgrade `@babel/traverse` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f63e7d78194b35d1", "name": "Vulnerable dependency uuid 3.4.0: GHSA-w5hq-g745-h8pq", "shortDescription": {"text": "Vulnerable dependency uuid 3.4.0: GHSA-w5hq-g745-h8pq"}, "fullDescription": {"text": "OSV.dev reports `uuid` at version `3.4.0` (resolved in `package-lock.json`) is affected by GHSA-w5hq-g745-h8pq.\nNote: `uuid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w5hq-g745-h8pq\nFix: upgrade `uuid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-da59fc3638e36a36", "name": "Vulnerable dependency ws 7.4.6: GHSA-3h5v-q93c-6h6q", "shortDescription": {"text": "Vulnerable dependency ws 7.4.6: GHSA-3h5v-q93c-6h6q"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `7.4.6` (resolved in `package-lock.json`) is affected by GHSA-3h5v-q93c-6h6q (aka CVE-2024-37890).\nNote: `ws` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nws affected by a DoS when handling a request with many HTTP headers\n\nAliases: CVE-2024-37890\nAdvisory: https://osv.dev/vulnerability/GHSA-3h5v-q93c-6h6q\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c5d197e7ddf3179f", "name": "Vulnerable dependency ws 7.4.6: GHSA-96hv-2xvq-fx4p", "shortDescription": {"text": "Vulnerable dependency ws 7.4.6: GHSA-96hv-2xvq-fx4p"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `7.4.6` (resolved in `package-lock.json`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779).\nNote: `ws` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nws: Memory exhaustion DoS from tiny fragments and data chunks\n\nAliases: CVE-2026-48779\nAdvisory: https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-b63fbeac1812e847", "name": "Vulnerable dependency ws 7.5.9: GHSA-3h5v-q93c-6h6q", "shortDescription": {"text": "Vulnerable dependency ws 7.5.9: GHSA-3h5v-q93c-6h6q"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `7.5.9` (resolved in `package-lock.json`) is affected by GHSA-3h5v-q93c-6h6q (aka CVE-2024-37890).\nNote: `ws` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nws affected by a DoS when handling a request with many HTTP headers\n\nAliases: CVE-2024-37890\nAdvisory: https://osv.dev/vulnerability/GHSA-3h5v-q93c-6h6q\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-8ea1eb4921da02c4", "name": "Vulnerable dependency ws 7.5.9: GHSA-96hv-2xvq-fx4p", "shortDescription": {"text": "Vulnerable dependency ws 7.5.9: GHSA-96hv-2xvq-fx4p"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `7.5.9` (resolved in `package-lock.json`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779).\nNote: `ws` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nws: Memory exhaustion DoS from tiny fragments and data chunks\n\nAliases: CVE-2026-48779\nAdvisory: https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a595fb760c6d133e", "name": "Vulnerable dependency @tootallnate/once 1.1.2: GHSA-vpq2-c234-7xj6", "shortDescription": {"text": "Vulnerable dependency @tootallnate/once 1.1.2: GHSA-vpq2-c234-7xj6"}, "fullDescription": {"text": "OSV.dev reports `@tootallnate/once` at version `1.1.2` (resolved in `package-lock.json`) is affected by GHSA-vpq2-c234-7xj6.\nNote: `@tootallnate/once` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `@tootallnate/once` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vpq2-c234-7xj6\nFix: upgrade `@tootallnate/once` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1560d66bd60c2ad9", "name": "Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6", "shortDescription": {"text": "Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6"}, "fullDescription": {"text": "OSV.dev reports `ajv` at version `6.12.6` (resolved in `package-lock.json`) is affected by GHSA-2g4f-4pwh-qvx6.\nNote: `ajv` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2g4f-4pwh-qvx6\nFix: upgrade `ajv` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9ad9d975e1fa86b7", "name": "Vulnerable dependency basic-ftp 5.0.4: GHSA-5rq4-664w-9x2c", "shortDescription": {"text": "Vulnerable dependency basic-ftp 5.0.4: GHSA-5rq4-664w-9x2c"}, "fullDescription": {"text": "OSV.dev reports `basic-ftp` at version `5.0.4` (resolved in `package-lock.json`) is affected by GHSA-5rq4-664w-9x2c.\nNote: `basic-ftp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5rq4-664w-9x2c\nFix: upgrade `basic-ftp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-927fe0422fc3a0e6", "name": "Vulnerable dependency basic-ftp 5.0.4: GHSA-6v7q-wjvx-w8wg", "shortDescription": {"text": "Vulnerable dependency basic-ftp 5.0.4: GHSA-6v7q-wjvx-w8wg"}, "fullDescription": {"text": "OSV.dev reports `basic-ftp` at version `5.0.4` (resolved in `package-lock.json`) is affected by GHSA-6v7q-wjvx-w8wg.\nNote: `basic-ftp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6v7q-wjvx-w8wg\nFix: upgrade `basic-ftp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-af3f2779dbc7573e", "name": "Vulnerable dependency basic-ftp 5.0.4: GHSA-rp42-5vxx-qpwr", "shortDescription": {"text": "Vulnerable dependency basic-ftp 5.0.4: GHSA-rp42-5vxx-qpwr"}, "fullDescription": {"text": "OSV.dev reports `basic-ftp` at version `5.0.4` (resolved in `package-lock.json`) is affected by GHSA-rp42-5vxx-qpwr.\nNote: `basic-ftp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rp42-5vxx-qpwr\nFix: upgrade `basic-ftp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1407ea0008f1600c", "name": "Vulnerable dependency basic-ftp 5.0.4: GHSA-rpmf-866q-6p89", "shortDescription": {"text": "Vulnerable dependency basic-ftp 5.0.4: GHSA-rpmf-866q-6p89"}, "fullDescription": {"text": "OSV.dev reports `basic-ftp` at version `5.0.4` (resolved in `package-lock.json`) is affected by GHSA-rpmf-866q-6p89.\nNote: `basic-ftp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rpmf-866q-6p89\nFix: upgrade `basic-ftp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ceba42c14772bd4e", "name": "Vulnerable dependency body-parser 1.20.1: GHSA-qwcr-r2fm-qrc7", "shortDescription": {"text": "Vulnerable dependency body-parser 1.20.1: GHSA-qwcr-r2fm-qrc7"}, "fullDescription": {"text": "OSV.dev reports `body-parser` at version `1.20.1` (resolved in `package-lock.json`) is affected by GHSA-qwcr-r2fm-qrc7.\nNote: `body-parser` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qwcr-r2fm-qrc7\nFix: upgrade `body-parser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ee8436bcf200e43f", "name": "Vulnerable dependency body-parser 1.20.1: GHSA-v422-hmwv-36x6", "shortDescription": {"text": "Vulnerable dependency body-parser 1.20.1: GHSA-v422-hmwv-36x6"}, "fullDescription": {"text": "OSV.dev reports `body-parser` at version `1.20.1` (resolved in `package-lock.json`) is affected by GHSA-v422-hmwv-36x6.\nNote: `body-parser` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v422-hmwv-36x6\nFix: upgrade `body-parser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-36f41499711b8115", "name": "Vulnerable dependency brace-expansion 1.1.11: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c5de61c3cbb551dc", "name": "Vulnerable dependency brace-expansion 1.1.11: GHSA-f886-m6hf-6m8v", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-f886-m6hf-6m8v"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `package-lock.json`) is affected by GHSA-f886-m6hf-6m8v.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f886-m6hf-6m8v\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b968a49260920fdb", "name": "Vulnerable dependency brace-expansion 1.1.11: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `package-lock.json`) is affected by GHSA-mh99-v99m-4gvg.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ffcf2ceae1166fd5", "name": "Vulnerable dependency brace-expansion 1.1.11: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `package-lock.json`) is affected by GHSA-rgw5-rvv9-x895.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c2c1e7358a045bf2", "name": "Vulnerable dependency brace-expansion 1.1.11: GHSA-v6h2-p8h4-qcjw", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-v6h2-p8h4-qcjw"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `package-lock.json`) is affected by GHSA-v6h2-p8h4-qcjw.\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v6h2-p8h4-qcjw\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-64077296e8cf1cee", "name": "Vulnerable dependency braces 3.0.2: GHSA-grv7-fg5c-xmjg", "shortDescription": {"text": "Vulnerable dependency braces 3.0.2: GHSA-grv7-fg5c-xmjg"}, "fullDescription": {"text": "OSV.dev reports `braces` at version `3.0.2` (resolved in `package-lock.json`) is affected by GHSA-grv7-fg5c-xmjg.\nNote: `braces` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-grv7-fg5c-xmjg\nFix: upgrade `braces` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-da02e6d118e4c7e3", "name": "Vulnerable dependency cookie 0.4.1: GHSA-pxg6-pf52-xh8x", "shortDescription": {"text": "Vulnerable dependency cookie 0.4.1: GHSA-pxg6-pf52-xh8x"}, "fullDescription": {"text": "OSV.dev reports `cookie` at version `0.4.1` (resolved in `package-lock.json`) is affected by GHSA-pxg6-pf52-xh8x (aka CVE-2024-47764).\nNote: `cookie` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\ncookie accepts cookie name, path, and domain with out of bounds characters\n\nAliases: CVE-2024-47764\nAdvisory: https://osv.dev/vulnerability/GHSA-pxg6-pf52-xh8x\nFix: upgrade `cookie` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-c6d563032fd590e7", "name": "Vulnerable dependency cross-spawn 7.0.3: GHSA-3xgq-45jj-v275", "shortDescription": {"text": "Vulnerable dependency cross-spawn 7.0.3: GHSA-3xgq-45jj-v275"}, "fullDescription": {"text": "OSV.dev reports `cross-spawn` at version `7.0.3` (resolved in `package-lock.json`) is affected by GHSA-3xgq-45jj-v275 (aka CVE-2024-21538).\nNote: `cross-spawn` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nRegular Expression Denial of Service (ReDoS) in cross-spawn\n\nAliases: CVE-2024-21538\nAdvisory: https://osv.dev/vulnerability/GHSA-3xgq-45jj-v275\nFix: upgrade `cross-spawn` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-18bbbe973b96ef7d", "name": "Vulnerable dependency dottie 2.0.3: GHSA-4gxf-g5gf-22h4", "shortDescription": {"text": "Vulnerable dependency dottie 2.0.3: GHSA-4gxf-g5gf-22h4"}, "fullDescription": {"text": "OSV.dev reports `dottie` at version `2.0.3` (resolved in `package-lock.json`) is affected by GHSA-4gxf-g5gf-22h4.\nNote: `dottie` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4gxf-g5gf-22h4\nFix: upgrade `dottie` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-844a3dd8d4586195", "name": "Vulnerable dependency engine.io 6.4.1: GHSA-q9mw-68c2-j6m5", "shortDescription": {"text": "Vulnerable dependency engine.io 6.4.1: GHSA-q9mw-68c2-j6m5"}, "fullDescription": {"text": "OSV.dev reports `engine.io` at version `6.4.1` (resolved in `package-lock.json`) is affected by GHSA-q9mw-68c2-j6m5.\nNote: `engine.io` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q9mw-68c2-j6m5\nFix: upgrade `engine.io` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-23cf84200e979400", "name": "Vulnerable dependency engine.io 6.4.1: GHSA-r635-g3xr-vw7x", "shortDescription": {"text": "Vulnerable dependency engine.io 6.4.1: GHSA-r635-g3xr-vw7x"}, "fullDescription": {"text": "OSV.dev reports `engine.io` at version `6.4.1` (resolved in `package-lock.json`) is affected by GHSA-r635-g3xr-vw7x.\nNote: `engine.io` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r635-g3xr-vw7x\nFix: upgrade `engine.io` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-0c61e2f4f6e0109d", "name": "Vulnerable dependency ws 8.11.0: GHSA-3h5v-q93c-6h6q", "shortDescription": {"text": "Vulnerable dependency ws 8.11.0: GHSA-3h5v-q93c-6h6q"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `8.11.0` (resolved in `package-lock.json`) is affected by GHSA-3h5v-q93c-6h6q (aka CVE-2024-37890).\nNote: `ws` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nws affected by a DoS when handling a request with many HTTP headers\n\nAliases: CVE-2024-37890\nAdvisory: https://osv.dev/vulnerability/GHSA-3h5v-q93c-6h6q\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-38e2cf3c08889666", "name": "Vulnerable dependency ws 8.11.0: GHSA-58qx-3vcg-4xpx", "shortDescription": {"text": "Vulnerable dependency ws 8.11.0: GHSA-58qx-3vcg-4xpx"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `8.11.0` (resolved in `package-lock.json`) is affected by GHSA-58qx-3vcg-4xpx.\nNote: `ws` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-58qx-3vcg-4xpx\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6b85cfb277d0e20e", "name": "Vulnerable dependency ws 8.11.0: GHSA-96hv-2xvq-fx4p", "shortDescription": {"text": "Vulnerable dependency ws 8.11.0: GHSA-96hv-2xvq-fx4p"}, "fullDescription": {"text": "OSV.dev reports `ws` at version `8.11.0` (resolved in `package-lock.json`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779).\nNote: `ws` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nws: Memory exhaustion DoS from tiny fragments and data chunks\n\nAliases: CVE-2026-48779\nAdvisory: https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p\nFix: upgrade `ws` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-4e16cffcf34511d5", "name": "Vulnerable dependency semver 6.3.0: GHSA-c2qf-rxjj-qqgw", "shortDescription": {"text": "Vulnerable dependency semver 6.3.0: GHSA-c2qf-rxjj-qqgw"}, "fullDescription": {"text": "OSV.dev reports `semver` at version `6.3.0` (resolved in `package-lock.json`) is affected by GHSA-c2qf-rxjj-qqgw.\nNote: `semver` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-c2qf-rxjj-qqgw\nFix: upgrade `semver` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e10cd8d36e5277e6", "name": "Vulnerable dependency cross-spawn 6.0.5: GHSA-3xgq-45jj-v275", "shortDescription": {"text": "Vulnerable dependency cross-spawn 6.0.5: GHSA-3xgq-45jj-v275"}, "fullDescription": {"text": "OSV.dev reports `cross-spawn` at version `6.0.5` (resolved in `package-lock.json`) is affected by GHSA-3xgq-45jj-v275 (aka CVE-2024-21538).\nNote: `cross-spawn` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nRegular Expression Denial of Service (ReDoS) in cross-spawn\n\nAliases: CVE-2024-21538\nAdvisory: https://osv.dev/vulnerability/GHSA-3xgq-45jj-v275\nFix: upgrade `cross-spawn` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-81122442855d6f47", "name": "Vulnerable dependency semver 5.7.1: GHSA-c2qf-rxjj-qqgw", "shortDescription": {"text": "Vulnerable dependency semver 5.7.1: GHSA-c2qf-rxjj-qqgw"}, "fullDescription": {"text": "OSV.dev reports `semver` at version `5.7.1` (resolved in `package-lock.json`) is affected by GHSA-c2qf-rxjj-qqgw.\nNote: `semver` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-c2qf-rxjj-qqgw\nFix: upgrade `semver` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-088e5349f8b3bb9d", "name": "Vulnerable dependency flatted 2.0.2: GHSA-25h7-pfq9-p65f", "shortDescription": {"text": "Vulnerable dependency flatted 2.0.2: GHSA-25h7-pfq9-p65f"}, "fullDescription": {"text": "OSV.dev reports `flatted` at version `2.0.2` (resolved in `package-lock.json`) is affected by GHSA-25h7-pfq9-p65f (aka CVE-2026-32141).\nNote: `flatted` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nflatted vulnerable to unbounded recursion DoS in parse() revive phase\n\nAliases: CVE-2026-32141\nAdvisory: https://osv.dev/vulnerability/GHSA-25h7-pfq9-p65f\nFix: upgrade `flatted` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-0fd7ca315101ea74", "name": "Vulnerable dependency flatted 2.0.2: GHSA-rf6f-7fwh-wjgh", "shortDescription": {"text": "Vulnerable dependency flatted 2.0.2: GHSA-rf6f-7fwh-wjgh"}, "fullDescription": {"text": "OSV.dev reports `flatted` at version `2.0.2` (resolved in `package-lock.json`) is affected by GHSA-rf6f-7fwh-wjgh.\nNote: `flatted` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rf6f-7fwh-wjgh\nFix: upgrade `flatted` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b1eb36fccbd6a82a", "name": "Vulnerable dependency js-yaml 3.14.1: GHSA-2883-xcg3-v3hh", "shortDescription": {"text": "Vulnerable dependency js-yaml 3.14.1: GHSA-2883-xcg3-v3hh"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `package-lock.json`) is affected by GHSA-2883-xcg3-v3hh.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2883-xcg3-v3hh\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-fa2c4bc3eeb626ce", "name": "Vulnerable dependency js-yaml 3.14.1: GHSA-52cp-r559-cp3m", "shortDescription": {"text": "Vulnerable dependency js-yaml 3.14.1: GHSA-52cp-r559-cp3m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `package-lock.json`) is affected by GHSA-52cp-r559-cp3m.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c62a300af29da974", "name": "Vulnerable dependency js-yaml 3.14.1: GHSA-5p4m-2wfm-xmqj", "shortDescription": {"text": "Vulnerable dependency js-yaml 3.14.1: GHSA-5p4m-2wfm-xmqj"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `package-lock.json`) is affected by GHSA-5p4m-2wfm-xmqj.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5p4m-2wfm-xmqj\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-960a1beee15fc5d7", "name": "Vulnerable dependency js-yaml 3.14.1: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "Vulnerable dependency js-yaml 3.14.1: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `package-lock.json`) is affected by GHSA-h67p-54hq-rp68.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d7a0e99bcfeb3fb7", "name": "Vulnerable dependency js-yaml 3.14.1: GHSA-mh29-5h37-fv8m", "shortDescription": {"text": "Vulnerable dependency js-yaml 3.14.1: GHSA-mh29-5h37-fv8m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `package-lock.json`) is affected by GHSA-mh29-5h37-fv8m.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mh29-5h37-fv8m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-53cb9106d0fae9bc", "name": "Vulnerable dependency cookie 0.4.2: GHSA-pxg6-pf52-xh8x", "shortDescription": {"text": "Vulnerable dependency cookie 0.4.2: GHSA-pxg6-pf52-xh8x"}, "fullDescription": {"text": "OSV.dev reports `cookie` at version `0.4.2` (resolved in `package-lock.json`) is affected by GHSA-pxg6-pf52-xh8x (aka CVE-2024-47764).\nNote: `cookie` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\ncookie accepts cookie name, path, and domain with out of bounds characters\n\nAliases: CVE-2024-47764\nAdvisory: https://osv.dev/vulnerability/GHSA-pxg6-pf52-xh8x\nFix: upgrade `cookie` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-c5347ac2c383802a", "name": "Vulnerable dependency cookie 0.5.0: GHSA-pxg6-pf52-xh8x", "shortDescription": {"text": "Vulnerable dependency cookie 0.5.0: GHSA-pxg6-pf52-xh8x"}, "fullDescription": {"text": "OSV.dev reports `cookie` at version `0.5.0` (resolved in `package-lock.json`) is affected by GHSA-pxg6-pf52-xh8x (aka CVE-2024-47764).\nNote: `cookie` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\ncookie accepts cookie name, path, and domain with out of bounds characters\n\nAliases: CVE-2024-47764\nAdvisory: https://osv.dev/vulnerability/GHSA-pxg6-pf52-xh8x\nFix: upgrade `cookie` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-b756203a323096f3", "name": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-8gc5-j5rx-235r", "shortDescription": {"text": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-8gc5-j5rx-235r"}, "fullDescription": {"text": "OSV.dev reports `fast-xml-parser` at version `4.1.2` (resolved in `package-lock.json`) is affected by GHSA-8gc5-j5rx-235r.\nNote: `fast-xml-parser` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `fast-xml-parser` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8gc5-j5rx-235r\nFix: upgrade `fast-xml-parser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-86635d8944d6005c", "name": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-fj3w-jwp8-x2g3", "shortDescription": {"text": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-fj3w-jwp8-x2g3"}, "fullDescription": {"text": "OSV.dev reports `fast-xml-parser` at version `4.1.2` (resolved in `package-lock.json`) is affected by GHSA-fj3w-jwp8-x2g3.\nNote: `fast-xml-parser` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `fast-xml-parser` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fj3w-jwp8-x2g3\nFix: upgrade `fast-xml-parser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d8030b230096cb00", "name": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-gh4j-gqv2-49f6", "shortDescription": {"text": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-gh4j-gqv2-49f6"}, "fullDescription": {"text": "OSV.dev reports `fast-xml-parser` at version `4.1.2` (resolved in `package-lock.json`) is affected by GHSA-gh4j-gqv2-49f6.\nNote: `fast-xml-parser` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `fast-xml-parser` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gh4j-gqv2-49f6\nFix: upgrade `fast-xml-parser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-265b20bf5a0fdc07", "name": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-jp2q-39xq-3w4g", "shortDescription": {"text": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-jp2q-39xq-3w4g"}, "fullDescription": {"text": "OSV.dev reports `fast-xml-parser` at version `4.1.2` (resolved in `package-lock.json`) is affected by GHSA-jp2q-39xq-3w4g.\nNote: `fast-xml-parser` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `fast-xml-parser` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jp2q-39xq-3w4g\nFix: upgrade `fast-xml-parser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e132e1f2564a0ce8", "name": "Vulnerable dependency flatted 3.2.7: GHSA-25h7-pfq9-p65f", "shortDescription": {"text": "Vulnerable dependency flatted 3.2.7: GHSA-25h7-pfq9-p65f"}, "fullDescription": {"text": "OSV.dev reports `flatted` at version `3.2.7` (resolved in `package-lock.json`) is affected by GHSA-25h7-pfq9-p65f (aka CVE-2026-32141).\nNote: `flatted` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nflatted vulnerable to unbounded recursion DoS in parse() revive phase\n\nAliases: CVE-2026-32141\nAdvisory: https://osv.dev/vulnerability/GHSA-25h7-pfq9-p65f\nFix: upgrade `flatted` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-556fbfe5d2899cc5", "name": "Vulnerable dependency flatted 3.2.7: GHSA-rf6f-7fwh-wjgh", "shortDescription": {"text": "Vulnerable dependency flatted 3.2.7: GHSA-rf6f-7fwh-wjgh"}, "fullDescription": {"text": "OSV.dev reports `flatted` at version `3.2.7` (resolved in `package-lock.json`) is affected by GHSA-rf6f-7fwh-wjgh.\nNote: `flatted` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rf6f-7fwh-wjgh\nFix: upgrade `flatted` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4b0bb8e8e1828f8c", "name": "Vulnerable dependency follow-redirects 1.15.2: GHSA-cxjh-pqwp-8mfp", "shortDescription": {"text": "Vulnerable dependency follow-redirects 1.15.2: GHSA-cxjh-pqwp-8mfp"}, "fullDescription": {"text": "OSV.dev reports `follow-redirects` at version `1.15.2` (resolved in `package-lock.json`) is affected by GHSA-cxjh-pqwp-8mfp.\nNote: `follow-redirects` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cxjh-pqwp-8mfp\nFix: upgrade `follow-redirects` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7ed06e2713e78d17", "name": "Vulnerable dependency follow-redirects 1.15.2: GHSA-jchw-25xp-jwwc", "shortDescription": {"text": "Vulnerable dependency follow-redirects 1.15.2: GHSA-jchw-25xp-jwwc"}, "fullDescription": {"text": "OSV.dev reports `follow-redirects` at version `1.15.2` (resolved in `package-lock.json`) is affected by GHSA-jchw-25xp-jwwc.\nNote: `follow-redirects` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jchw-25xp-jwwc\nFix: upgrade `follow-redirects` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c9dc771cf51c6db2", "name": "Vulnerable dependency follow-redirects 1.15.2: GHSA-r4q5-vmmm-2653", "shortDescription": {"text": "Vulnerable dependency follow-redirects 1.15.2: GHSA-r4q5-vmmm-2653"}, "fullDescription": {"text": "OSV.dev reports `follow-redirects` at version `1.15.2` (resolved in `package-lock.json`) is affected by GHSA-r4q5-vmmm-2653.\nNote: `follow-redirects` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r4q5-vmmm-2653\nFix: upgrade `follow-redirects` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d6454b9324cebbd2", "name": "Dependency bcrypt is a major version behind", "shortDescription": {"text": "Dependency bcrypt is a major version behind"}, "fullDescription": {"text": "`bcrypt` is pinned at `5.0.1` in `package.json` while the latest release on the npm registry is `6.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `bcrypt` to `6.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-2947101fc867a39c", "name": "Dependency canvas is a major version behind", "shortDescription": {"text": "Dependency canvas is a major version behind"}, "fullDescription": {"text": "`canvas` is pinned at `2.9.1` in `package.json` while the latest release on the npm registry is `3.2.3` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `canvas` to `3.2.3`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-655bd925d7a4dedf", "name": "Dependency eta is two or more major versions behind", "shortDescription": {"text": "Dependency eta is two or more major versions behind"}, "fullDescription": {"text": "`eta` is pinned at `1.12.3` in `package.json` while the latest release on the npm registry is `4.6.0` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `eta` to `4.6.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3719d1be68e7982b", "name": "Dependency express-rate-limit is two or more major versions behind", "shortDescription": {"text": "Dependency express-rate-limit is two or more major versions behind"}, "fullDescription": {"text": "`express-rate-limit` is pinned at `6.5.2` in `package.json` while the latest release on the npm registry is `8.7.0` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `express-rate-limit` to `8.7.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a736687f245203a6", "name": "Dependency express is a major version behind", "shortDescription": {"text": "Dependency express is a major version behind"}, "fullDescription": {"text": "`express` is pinned at `4.18.1` in `package.json` while the latest release on the npm registry is `5.2.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `express` to `5.2.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-760a6a76539cb85e", "name": "Dependency googleapis is two or more major versions behind", "shortDescription": {"text": "Dependency googleapis is two or more major versions behind"}, "fullDescription": {"text": "`googleapis` is pinned at `100.0.0` in `package.json` while the latest release on the npm registry is `181.0.0` \u2014 81 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `googleapis` to `181.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1a02963b7b3e3358", "name": "Dependency gradient-string is a major version behind", "shortDescription": {"text": "Dependency gradient-string is a major version behind"}, "fullDescription": {"text": "`gradient-string` is pinned at `2.0.2` in `package.json` while the latest release on the npm registry is `3.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `gradient-string` to `3.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-44e80cddd45627e9", "name": "Dependency mongoose is two or more major versions behind", "shortDescription": {"text": "Dependency mongoose is two or more major versions behind"}, "fullDescription": {"text": "`mongoose` is pinned at `6.3.1` in `package.json` while the latest release on the npm registry is `9.10.1` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `mongoose` to `9.10.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2c5b8cd62495e1b1", "name": "Dependency mqtt is a major version behind", "shortDescription": {"text": "Dependency mqtt is a major version behind"}, "fullDescription": {"text": "`mqtt` is pinned at `4.3.7` in `package.json` while the latest release on the npm registry is `5.16.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `mqtt` to `5.16.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-24d5291fa5bced4c", "name": "Dependency node-cron is a major version behind", "shortDescription": {"text": "Dependency node-cron is a major version behind"}, "fullDescription": {"text": "`node-cron` is pinned at `3.0.2` in `package.json` while the latest release on the npm registry is `4.6.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `node-cron` to `4.6.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-8b0d2ffebae41a8a", "name": "Dependency nodemailer is two or more major versions behind", "shortDescription": {"text": "Dependency nodemailer is two or more major versions behind"}, "fullDescription": {"text": "`nodemailer` is pinned at `6.7.5` in `package.json` while the latest release on the npm registry is `10.0.10` \u2014 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `nodemailer` to `10.0.10`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-35e3030a1338ca76", "name": "Dependency ora is two or more major versions behind", "shortDescription": {"text": "Dependency ora is two or more major versions behind"}, "fullDescription": {"text": "`ora` is pinned at `5.4.1` in `package.json` while the latest release on the npm registry is `9.4.1` \u2014 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ora` to `9.4.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9cdabee93ef5c35b", "name": "Dependency sqlite3 is a major version behind", "shortDescription": {"text": "Dependency sqlite3 is a major version behind"}, "fullDescription": {"text": "`sqlite3` is pinned at `5.0.5` in `package.json` while the latest release on the npm registry is `6.0.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `sqlite3` to `6.0.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-799af57a127bf271", "name": "Dependency totp-generator is two or more major versions behind", "shortDescription": {"text": "Dependency totp-generator is two or more major versions behind"}, "fullDescription": {"text": "`totp-generator` is pinned at `0.0.13` in `package.json` while the latest release on the npm registry is `2.0.1` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `totp-generator` to `2.0.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-842b641b8d0d6ee4", "name": "13 backend endpoints not called by scanned frontend", "shortDescription": {"text": "13 backend endpoints not called by scanned frontend"}, "fullDescription": {"text": "No scanned frontend call matched these backend routes. Sample: GET /uptime, USE /css, USE /js, USE /images, GET /stats, GET /donate, POST /changefbstate, GET /changefbstate + 5 more. This is fine when endpoints serve external clients (mobile apps, SDKs, third-party integrations, server-side webhooks). Otherwise document consumers or remove dead routes."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30832"}, "properties": {"repository": "Ntkhang03/Goat-Bot-V2", "repoUrl": "https://github.com/Ntkhang03/Goat-Bot-V2", "branch": "main"}, "results": [{"ruleId": "scanner-8c797f5b54431d71", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 fb-chat-api/utils.js:366"}, "properties": {"repobilityId": "8ef741422098fb0d", "scanner": "scanner-primary", "fingerprint": "8c797f5b54431d71", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fb-chat-api/utils.js"}, "region": {"startLine": 366}}}]}, {"ruleId": "scanner-8e44341e7a6522a1", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 fb-chat-api/src/listenMqtt.js:41"}, "properties": {"repobilityId": "e3bbaba995792adb", "scanner": "scanner-primary", "fingerprint": "8e44341e7a6522a1", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fb-chat-api/src/listenMqtt.js"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-91387390330a0caf", "level": "warning", "message": {"text": "detect child process \u2014 Goat.js:37"}, "properties": {"repobilityId": "0b545f4a17aeb0bf", "scanner": "scanner-primary", "fingerprint": "91387390330a0caf", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Goat.js"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-b5198870f9bf83cc", "level": "warning", "message": {"text": "detect child process \u2014 scripts/cmds/cmd.js:327"}, "properties": {"repobilityId": "133007940132ebde", "scanner": "scanner-primary", "fingerprint": "b5198870f9bf83cc", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cmds/cmd.js"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-a2c5bdc6171b265f", "level": "note", "message": {"text": "CVE-2026-3449: @tootallnate/once 1.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "f9189f450b4bea73", "scanner": "scanner-primary", "fingerprint": "a2c5bdc6171b265f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-3449"]}}, {"ruleId": "scanner-86bcf83af42dc2eb", "level": "warning", "message": {"text": "CVE-2025-69873: ajv 6.12.6 \u2014 package-lock.json"}, "properties": {"repobilityId": "f8e92f8faeb89762", "scanner": "scanner-primary", "fingerprint": "86bcf83af42dc2eb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-69873"]}}, {"ruleId": "scanner-cea3613d60a67484", "level": "error", "message": {"text": "CVE-2024-39338: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "ea4690930a109b9a", "scanner": "scanner-primary", "fingerprint": "cea3613d60a67484", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-39338"]}}, {"ruleId": "scanner-03fda173b539cc35", "level": "error", "message": {"text": "CVE-2025-27152: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "d1ae9d2ee93c404f", "scanner": "scanner-primary", "fingerprint": "03fda173b539cc35", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-27152"]}}, {"ruleId": "scanner-48882f66f92ac0ec", "level": "error", "message": {"text": "CVE-2025-58754: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "0811edfe11816719", "scanner": "scanner-primary", "fingerprint": "48882f66f92ac0ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-58754"]}}, {"ruleId": "scanner-b1ea201195619a7b", "level": "error", "message": {"text": "CVE-2026-25639: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "893516f3a969cf4d", "scanner": "scanner-primary", "fingerprint": "b1ea201195619a7b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25639"]}}, {"ruleId": "scanner-1380111c1617de81", "level": "error", "message": {"text": "CVE-2026-42033: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "66ab42945a9252b4", "scanner": "scanner-primary", "fingerprint": "1380111c1617de81", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42033"]}}, {"ruleId": "scanner-2eb9f6dc9a77d06e", "level": "error", "message": {"text": "CVE-2026-42035: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "32a44b7270364eea", "scanner": "scanner-primary", "fingerprint": "2eb9f6dc9a77d06e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42035"]}}, {"ruleId": "scanner-11abd60530a4eb0f", "level": "error", "message": {"text": "CVE-2026-42043: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "402c47d4952ad621", "scanner": "scanner-primary", "fingerprint": "11abd60530a4eb0f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42043"]}}, {"ruleId": "scanner-d15871fbbc6ad0df", "level": "error", "message": {"text": "CVE-2026-42264: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "5b30f0486a26b515", "scanner": "scanner-primary", "fingerprint": "d15871fbbc6ad0df", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42264"]}}, {"ruleId": "scanner-72e4060584f21f4d", "level": "error", "message": {"text": "CVE-2026-44486: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "df95d747ea8a5d48", "scanner": "scanner-primary", "fingerprint": "72e4060584f21f4d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44486"]}}, {"ruleId": "scanner-65575422d10cde60", "level": "error", "message": {"text": "CVE-2026-44487: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "dc0fed2a6be758a2", "scanner": "scanner-primary", "fingerprint": "65575422d10cde60", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44487"]}}, {"ruleId": "scanner-7157792fe24dda6b", "level": "error", "message": {"text": "CVE-2026-44494: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "b638ad8e237c2f3f", "scanner": "scanner-primary", "fingerprint": "7157792fe24dda6b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44494"]}}, {"ruleId": "scanner-a1f9d13ff483226a", "level": "error", "message": {"text": "CVE-2026-44495: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "3f9275d1c9c505dc", "scanner": "scanner-primary", "fingerprint": "a1f9d13ff483226a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44495"]}}, {"ruleId": "scanner-ca1a96e7b876978a", "level": "error", "message": {"text": "CVE-2026-44496: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "0a52470db40718ce", "scanner": "scanner-primary", "fingerprint": "ca1a96e7b876978a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44496"]}}, {"ruleId": "scanner-afa580af5ddbefdc", "level": "warning", "message": {"text": "CVE-2023-45857: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "c6455b56140fc23a", "scanner": "scanner-primary", "fingerprint": "afa580af5ddbefdc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-45857"]}}, {"ruleId": "scanner-277d26cdfbd8e00a", "level": "warning", "message": {"text": "CVE-2025-62718: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "0a3a23c9b0ec4c3f", "scanner": "scanner-primary", "fingerprint": "277d26cdfbd8e00a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-62718"]}}, {"ruleId": "scanner-65e4aec041a94daf", "level": "warning", "message": {"text": "CVE-2026-40175: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "09f9c1fa112e982d", "scanner": "scanner-primary", "fingerprint": "65e4aec041a94daf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40175"]}}, {"ruleId": "scanner-12c068e1aed69b53", "level": "warning", "message": {"text": "CVE-2026-42034: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "68961d2711064045", "scanner": "scanner-primary", "fingerprint": "12c068e1aed69b53", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42034"]}}, {"ruleId": "scanner-629f001407e7fc1c", "level": "warning", "message": {"text": "CVE-2026-42036: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "a6dac289ee8c33a1", "scanner": "scanner-primary", "fingerprint": "629f001407e7fc1c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42036"]}}, {"ruleId": "scanner-12a4842e4110cad2", "level": "warning", "message": {"text": "CVE-2026-42037: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "2414e86d5aed4540", "scanner": "scanner-primary", "fingerprint": "12a4842e4110cad2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42037"]}}, {"ruleId": "scanner-2fd974d015c705a5", "level": "warning", "message": {"text": "CVE-2026-42038: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "f15c3e4f66531770", "scanner": "scanner-primary", "fingerprint": "2fd974d015c705a5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42038"]}}, {"ruleId": "scanner-855ae52cd5e0c22f", "level": "warning", "message": {"text": "CVE-2026-42039: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "53340df3286c4767", "scanner": "scanner-primary", "fingerprint": "855ae52cd5e0c22f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42039"]}}, {"ruleId": "scanner-056e7a7be728ea68", "level": "warning", "message": {"text": "CVE-2026-42041: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "6c9b27969c48ada0", "scanner": "scanner-primary", "fingerprint": "056e7a7be728ea68", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42041"]}}, {"ruleId": "scanner-d9829c8a4091a8f9", "level": "warning", "message": {"text": "CVE-2026-42042: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "34e7b8dbf2f6a9a6", "scanner": "scanner-primary", "fingerprint": "d9829c8a4091a8f9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42042"]}}, {"ruleId": "scanner-42e2e333fc6d66f8", "level": "warning", "message": {"text": "CVE-2026-42044: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "b6e4b8fbb6a62d79", "scanner": "scanner-primary", "fingerprint": "42e2e333fc6d66f8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42044"]}}, {"ruleId": "scanner-c6cf1d392f6ddce5", "level": "warning", "message": {"text": "CVE-2026-44490: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "ae6ee68d61b62013", "scanner": "scanner-primary", "fingerprint": "c6cf1d392f6ddce5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44490"]}}, {"ruleId": "scanner-6e74829e722c6282", "level": "warning", "message": {"text": "CVE-2026-67312: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "215257e8a63195a2", "scanner": "scanner-primary", "fingerprint": "6e74829e722c6282", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67312"]}}, {"ruleId": "scanner-10bf4cff73d78070", "level": "warning", "message": {"text": "CVE-2026-67313: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "a0317c71238ad6b7", "scanner": "scanner-primary", "fingerprint": "10bf4cff73d78070", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67313"]}}, {"ruleId": "scanner-990991581948cf91", "level": "warning", "message": {"text": "CVE-2026-67316: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "cb3138eb78c28ceb", "scanner": "scanner-primary", "fingerprint": "990991581948cf91", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67316"]}}, {"ruleId": "scanner-8cd83f710da84e71", "level": "warning", "message": {"text": "CVE-2026-67319: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "519234039e9637b7", "scanner": "scanner-primary", "fingerprint": "8cd83f710da84e71", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67319"]}}, {"ruleId": "scanner-d4726b2d323faa39", "level": "note", "message": {"text": "CVE-2026-42040: axios 1.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "e1251f5883d576f5", "scanner": "scanner-primary", "fingerprint": "d4726b2d323faa39", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42040"]}}, {"ruleId": "scanner-897bd6dfb595e55b", "level": "error", "message": {"text": "CVE-2024-45590: body-parser 1.20.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "c084b3ee6e46066e", "scanner": "scanner-primary", "fingerprint": "897bd6dfb595e55b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-45590"]}}, {"ruleId": "scanner-5b0ae2d774d3f213", "level": "note", "message": {"text": "CVE-2026-12590: body-parser 1.20.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "2cc3cf9d6ecedcda", "scanner": "scanner-primary", "fingerprint": "5b0ae2d774d3f213", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12590"]}}, {"ruleId": "scanner-41aeed0cdec09958", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 1.1.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "8775b18ee2ab6ac7", "scanner": "scanner-primary", "fingerprint": "41aeed0cdec09958", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-e129f76ffd62afa3", "level": "error", "message": {"text": "CVE-2026-14257: brace-expansion 1.1.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "54f567a7570eb6ed", "scanner": "scanner-primary", "fingerprint": "e129f76ffd62afa3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-14257"]}}, {"ruleId": "scanner-53a565b68abde6fa", "level": "error", "message": {"text": "CVE-2026-69152: brace-expansion 1.1.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "205d24bcd77a4394", "scanner": "scanner-primary", "fingerprint": "53a565b68abde6fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69152"]}}, {"ruleId": "scanner-0e0d93e508ef6102", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 1.1.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "177d9c72ba8538b6", "scanner": "scanner-primary", "fingerprint": "0e0d93e508ef6102", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-157cac5b75a99569", "level": "note", "message": {"text": "CVE-2025-5889: brace-expansion 1.1.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "dfb57c2bdc24714a", "scanner": "scanner-primary", "fingerprint": "157cac5b75a99569", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5889"]}}, {"ruleId": "scanner-f32b69251dba4d22", "level": "note", "message": {"text": "CVE-2024-47764: cookie 0.4.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "c52b4f3bc8f1a0d7", "scanner": "scanner-primary", "fingerprint": "f32b69251dba4d22", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-47764"]}}, {"ruleId": "scanner-fe93d5e2ad997fca", "level": "note", "message": {"text": "CVE-2024-47764: cookie 0.4.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "c52b4f3bc8f1a0d7", "scanner": "scanner-primary", "fingerprint": "fe93d5e2ad997fca", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-47764"]}}, {"ruleId": "scanner-19d16e0e0475ce77", "level": "note", "message": {"text": "CVE-2024-47764: cookie 0.5.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "c52b4f3bc8f1a0d7", "scanner": "scanner-primary", "fingerprint": "19d16e0e0475ce77", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-47764"]}}, {"ruleId": "scanner-0340199ca2ddda87", "level": "error", "message": {"text": "CVE-2023-26132: dottie 2.0.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "d8584356cb979d20", "scanner": "scanner-primary", "fingerprint": "0340199ca2ddda87", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-26132"]}}, {"ruleId": "scanner-819523fc72181790", "level": "error", "message": {"text": "CVE-2026-59725: engine.io 6.4.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "0eaaa8dbc642c3da", "scanner": "scanner-primary", "fingerprint": "819523fc72181790", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59725"]}}, {"ruleId": "scanner-636841d6933ebb3a", "level": "warning", "message": {"text": "CVE-2023-31125: engine.io 6.4.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "671fa4135eaa6431", "scanner": "scanner-primary", "fingerprint": "636841d6933ebb3a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-31125"]}}, {"ruleId": "scanner-378dbc04593eca53", "level": "error", "message": {"text": "CVE-2022-25967: eta 1.12.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "0408907eb9571b8d", "scanner": "scanner-primary", "fingerprint": "378dbc04593eca53", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-25967"]}}, {"ruleId": "scanner-2e32f38f6438c08c", "level": "error", "message": {"text": "CVE-2023-23630: eta 1.12.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "a7f4de87d0e83ebd", "scanner": "scanner-primary", "fingerprint": "2e32f38f6438c08c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-23630"]}}, {"ruleId": "scanner-fa70dd8968a95a7a", "level": "warning", "message": {"text": "CVE-2024-29041: express 4.18.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "d3f9f80ef54a3f36", "scanner": "scanner-primary", "fingerprint": "fa70dd8968a95a7a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-29041"]}}, {"ruleId": "scanner-339546f1a7d7e542", "level": "note", "message": {"text": "CVE-2024-43796: express 4.18.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "eb0cc5ab99e6b8c5", "scanner": "scanner-primary", "fingerprint": "339546f1a7d7e542", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-43796"]}}, {"ruleId": "scanner-cb01fa29d31e630f", "level": "error", "message": {"text": "CVE-2026-33036: fast-xml-parser 4.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "60e281b86ce1b962", "scanner": "scanner-primary", "fingerprint": "cb01fa29d31e630f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33036"]}}, {"ruleId": "scanner-20a7add84e12cc51", "level": "warning", "message": {"text": "CVE-2026-33349: fast-xml-parser 4.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "a7fa6164284b9382", "scanner": "scanner-primary", "fingerprint": "20a7add84e12cc51", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33349"]}}, {"ruleId": "scanner-e4a8b4397687e9c2", "level": "warning", "message": {"text": "CVE-2026-41650: fast-xml-parser 4.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "649bb6de9d56303f", "scanner": "scanner-primary", "fingerprint": "e4a8b4397687e9c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41650"]}}, {"ruleId": "scanner-a0e166f708b42f9a", "level": "note", "message": {"text": "CVE-2026-27942: fast-xml-parser 4.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "594a4796f4cf2e04", "scanner": "scanner-primary", "fingerprint": "a0e166f708b42f9a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27942"]}}, {"ruleId": "scanner-73a0b218d8ffc0a3", "level": "warning", "message": {"text": "CVE-2023-26159: follow-redirects 1.15.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "b7e9224a07df8819", "scanner": "scanner-primary", "fingerprint": "73a0b218d8ffc0a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-26159"]}}, {"ruleId": "scanner-17cbd36c3eff6ce5", "level": "warning", "message": {"text": "CVE-2024-28849: follow-redirects 1.15.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "91ba14608f4bf885", "scanner": "scanner-primary", "fingerprint": "17cbd36c3eff6ce5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-28849"]}}, {"ruleId": "scanner-18c1bc683d27c5a0", "level": "warning", "message": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "e85192b558a626b4", "scanner": "scanner-primary", "fingerprint": "18c1bc683d27c5a0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-r4q5-vmmm-2653"]}}, {"ruleId": "scanner-eacfd54ee0109df3", "level": "error", "message": {"text": "CVE-2025-7783: form-data 2.3.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "d2df4b39e56ba77a", "scanner": "scanner-primary", "fingerprint": "eacfd54ee0109df3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-7783"]}}, {"ruleId": "scanner-07b67bc2a5f882e9", "level": "error", "message": {"text": "CVE-2026-12143: form-data 2.3.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "283ecf327c9979f0", "scanner": "scanner-primary", "fingerprint": "07b67bc2a5f882e9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12143"]}}, {"ruleId": "scanner-297f4060ca5cc7d6", "level": "error", "message": {"text": "CVE-2025-7783: form-data 4.0.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "d2df4b39e56ba77a", "scanner": "scanner-primary", "fingerprint": "297f4060ca5cc7d6", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-7783"]}}, {"ruleId": "scanner-84b3c23f6d6cc724", "level": "error", "message": {"text": "CVE-2026-12143: form-data 4.0.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "283ecf327c9979f0", "scanner": "scanner-primary", "fingerprint": "84b3c23f6d6cc724", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12143"]}}, {"ruleId": "scanner-f643b6996cbd2a0d", "level": "error", "message": {"text": "CVE-2024-29415: ip 2.0.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "3eb232ae690d431e", "scanner": "scanner-primary", "fingerprint": "f643b6996cbd2a0d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-29415"]}}, {"ruleId": "scanner-c0759cb88bff45cf", "level": "note", "message": {"text": "CVE-2023-42282: ip 2.0.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "25fe9a5d0b3794d4", "scanner": "scanner-primary", "fingerprint": "c0759cb88bff45cf", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-42282"]}}, {"ruleId": "scanner-bb7b90e2c5dad2f5", "level": "error", "message": {"text": "CVE-2025-65945: jws 4.0.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "44d0bd884a22483b", "scanner": "scanner-primary", "fingerprint": "bb7b90e2c5dad2f5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-65945"]}}, {"ruleId": "scanner-bdb0ff330db7f641", "level": "error", "message": {"text": "CVE-2026-4800: lodash 4.17.21 \u2014 package-lock.json"}, "properties": {"repobilityId": "9e31ffbbadb525da", "scanner": "scanner-primary", "fingerprint": "bdb0ff330db7f641", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4800"]}}, {"ruleId": "scanner-488c54428fc34f0d", "level": "warning", "message": {"text": "CVE-2025-13465: lodash 4.17.21 \u2014 package-lock.json"}, "properties": {"repobilityId": "9a4008c6507da8c3", "scanner": "scanner-primary", "fingerprint": "488c54428fc34f0d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13465"]}}, {"ruleId": "scanner-8832f52283a5d751", "level": "warning", "message": {"text": "CVE-2026-2950: lodash 4.17.21 \u2014 package-lock.json"}, "properties": {"repobilityId": "e5ea47dec8a5f16f", "scanner": "scanner-primary", "fingerprint": "8832f52283a5d751", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2950"]}}, {"ruleId": "scanner-64ecea76e6bc5e09", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 3.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "94bff1e4bae0d172", "scanner": "scanner-primary", "fingerprint": "64ecea76e6bc5e09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-5547d992435923f9", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 3.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "49768a082ae8a15a", "scanner": "scanner-primary", "fingerprint": "5547d992435923f9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-fc1422d1987f9a44", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 3.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "ad1a2b4ec39282c6", "scanner": "scanner-primary", "fingerprint": "fc1422d1987f9a44", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-b17dadd5b14d4afa", "level": "warning", "message": {"text": "CVE-2021-32050: mongodb 4.14.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "6a12fb95a0ab076a", "scanner": "scanner-primary", "fingerprint": "b17dadd5b14d4afa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2021-32050"]}}, {"ruleId": "scanner-aff434348edaaeed", "level": "error", "message": {"text": "CVE-2023-3696: mongoose 6.10.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "d7e719a49acbde51", "scanner": "scanner-primary", "fingerprint": "aff434348edaaeed", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-3696"]}}, {"ruleId": "scanner-fef1168e421a314b", "level": "error", "message": {"text": "CVE-2025-23061: mongoose 6.10.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "d2da8bbfddfb53b2", "scanner": "scanner-primary", "fingerprint": "fef1168e421a314b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-23061"]}}, {"ruleId": "scanner-e9eb77afaa18ef1c", "level": "error", "message": {"text": "CVE-2024-53900: mongoose 6.10.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "f916bc4c6547e5a2", "scanner": "scanner-primary", "fingerprint": "e9eb77afaa18ef1c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-53900"]}}, {"ruleId": "scanner-06e87146f6f79f28", "level": "error", "message": {"text": "CVE-2026-42334: mongoose 6.10.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "36fee9a6ca31c44d", "scanner": "scanner-primary", "fingerprint": "06e87146f6f79f28", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42334"]}}, {"ruleId": "scanner-f06bb598913935b2", "level": "warning", "message": {"text": "CVE-2026-73562: mongoose 6.10.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "85a23e4fb34f1352", "scanner": "scanner-primary", "fingerprint": "f06bb598913935b2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73562"]}}, {"ruleId": "scanner-b51ba123c372d459", "level": "error", "message": {"text": "CVE-2025-12816: node-forge 1.3.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "ce1b91e898e1933b", "scanner": "scanner-primary", "fingerprint": "b51ba123c372d459", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-12816"]}}, {"ruleId": "scanner-7e6ac772c3c6a67c", "level": "error", "message": {"text": "CVE-2025-66031: node-forge 1.3.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "0656fb99cbeba7a4", "scanner": "scanner-primary", "fingerprint": "7e6ac772c3c6a67c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-66031"]}}, {"ruleId": "scanner-ae057a9cd3e8ed27", "level": "error", "message": {"text": "CVE-2026-33891: node-forge 1.3.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "c7c6ef731a013fdd", "scanner": "scanner-primary", "fingerprint": "ae057a9cd3e8ed27", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33891"]}}, {"ruleId": "scanner-0b1a2cd7c4d84f70", "level": "error", "message": {"text": "CVE-2026-33894: node-forge 1.3.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "7f9224575aaeae48", "scanner": "scanner-primary", "fingerprint": "0b1a2cd7c4d84f70", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33894"]}}, {"ruleId": "scanner-59942bc063cd210c", "level": "error", "message": {"text": "CVE-2026-33895: node-forge 1.3.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "8df87fa1adead5e2", "scanner": "scanner-primary", "fingerprint": "59942bc063cd210c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33895"]}}, {"ruleId": "scanner-06858e62a94339d7", "level": "error", "message": {"text": "CVE-2026-33896: node-forge 1.3.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "e637ef892e0cf13c", "scanner": "scanner-primary", "fingerprint": "06858e62a94339d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33896"]}}, {"ruleId": "scanner-270e43a709d2cf45", "level": "warning", "message": {"text": "CVE-2025-66030: node-forge 1.3.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "9d982163218a4360", "scanner": "scanner-primary", "fingerprint": "270e43a709d2cf45", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-66030"]}}, {"ruleId": "scanner-4f88342e1b2334cc", "level": "error", "message": {"text": "CVE-2025-14874: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "76c8006c8a51af5a", "scanner": "scanner-primary", "fingerprint": "4f88342e1b2334cc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-14874"]}}, {"ruleId": "scanner-1c17d43db6b3c3de", "level": "error", "message": {"text": "CVE-2026-82659: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "7325ae83189ec497", "scanner": "scanner-primary", "fingerprint": "1c17d43db6b3c3de", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82659"]}}, {"ruleId": "scanner-2e12b82772d34e0c", "level": "error", "message": {"text": "GHSA-2x7j-588g-ccc2: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "8924d941dcb54ff2", "scanner": "scanner-primary", "fingerprint": "2e12b82772d34e0c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-2x7j-588g-ccc2"]}}, {"ruleId": "scanner-c2eef2c5806709e7", "level": "warning", "message": {"text": "CVE-2025-13033: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "e4a069a307c191b9", "scanner": "scanner-primary", "fingerprint": "c2eef2c5806709e7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13033"]}}, {"ruleId": "scanner-a307a524196211b0", "level": "warning", "message": {"text": "GHSA-268h-hp4c-crq3: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "667f10948bb994eb", "scanner": "scanner-primary", "fingerprint": "a307a524196211b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-268h-hp4c-crq3"]}}, {"ruleId": "scanner-6e62d90c0dc11ec7", "level": "warning", "message": {"text": "GHSA-8m3c-c648-2xjj: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "01c37077d6faab01", "scanner": "scanner-primary", "fingerprint": "6e62d90c0dc11ec7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-8m3c-c648-2xjj"]}}, {"ruleId": "scanner-b08e08ee332e5c41", "level": "warning", "message": {"text": "GHSA-9h6g-pr28-7cqp: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "c6c3b26a855a67bb", "scanner": "scanner-primary", "fingerprint": "b08e08ee332e5c41", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-9h6g-pr28-7cqp"]}}, {"ruleId": "scanner-e224b5b1c713845f", "level": "warning", "message": {"text": "GHSA-r7g4-qg5f-qqm2: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "428506f2ee2c304e", "scanner": "scanner-primary", "fingerprint": "e224b5b1c713845f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-r7g4-qg5f-qqm2"]}}, {"ruleId": "scanner-102ae7f83eaabbd3", "level": "warning", "message": {"text": "GHSA-vvjj-xcjg-gr5g: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "3676665b94810b3a", "scanner": "scanner-primary", "fingerprint": "102ae7f83eaabbd3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-vvjj-xcjg-gr5g"]}}, {"ruleId": "scanner-701cec4a808bafec", "level": "warning", "message": {"text": "GHSA-wmmp-3585-3rmp: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "624ef9bf195057ff", "scanner": "scanner-primary", "fingerprint": "701cec4a808bafec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-wmmp-3585-3rmp"]}}, {"ruleId": "scanner-bf53a4fd37b3f341", "level": "warning", "message": {"text": "GHSA-wqvq-jvpq-h66f: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "c124360e315593c7", "scanner": "scanner-primary", "fingerprint": "bf53a4fd37b3f341", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-wqvq-jvpq-h66f"]}}, {"ruleId": "scanner-89f5e8aa72414011", "level": "note", "message": {"text": "GHSA-c7w3-x93f-qmm8: nodemailer 6.9.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "e750a348753add40", "scanner": "scanner-primary", "fingerprint": "89f5e8aa72414011", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-c7w3-x93f-qmm8"]}}, {"ruleId": "scanner-670db14a265d87ba", "level": "note", "message": {"text": "CVE-2025-7339: on-headers 1.0.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "4ded66707133081f", "scanner": "scanner-primary", "fingerprint": "670db14a265d87ba", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-7339"]}}, {"ruleId": "scanner-7776210b363cdbb0", "level": "error", "message": {"text": "CVE-2024-45296: path-to-regexp 0.1.7 \u2014 package-lock.json"}, "properties": {"repobilityId": "bf44ab8c4a4bb310", "scanner": "scanner-primary", "fingerprint": "7776210b363cdbb0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-45296"]}}, {"ruleId": "scanner-706b8c2de5621524", "level": "error", "message": {"text": "CVE-2024-52798: path-to-regexp 0.1.7 \u2014 package-lock.json"}, "properties": {"repobilityId": "dc21a4cf74fae820", "scanner": "scanner-primary", "fingerprint": "706b8c2de5621524", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-52798"]}}, {"ruleId": "scanner-ea0301ce2a43bdb7", "level": "error", "message": {"text": "CVE-2026-4867: path-to-regexp 0.1.7 \u2014 package-lock.json"}, "properties": {"repobilityId": "14d7fcb7dded9249", "scanner": "scanner-primary", "fingerprint": "ea0301ce2a43bdb7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4867"]}}, {"ruleId": "scanner-65aa59d9cc789369", "level": "warning", "message": {"text": "CVE-2025-15284: qs 6.11.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "212dfaee90ca0f43", "scanner": "scanner-primary", "fingerprint": "65aa59d9cc789369", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15284"]}}, {"ruleId": "scanner-65f53e3e6ca4b192", "level": "warning", "message": {"text": "CVE-2026-82417: qs 6.11.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "a7f7ddde050b0bff", "scanner": "scanner-primary", "fingerprint": "65f53e3e6ca4b192", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82417"]}}, {"ruleId": "scanner-1ee6dd2ee8a0e64e", "level": "note", "message": {"text": "CVE-2026-2391: qs 6.11.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "5828ea7bea940935", "scanner": "scanner-primary", "fingerprint": "1ee6dd2ee8a0e64e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2391"]}}, {"ruleId": "scanner-688648ec21c7285f", "level": "warning", "message": {"text": "CVE-2025-15284: qs 6.11.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "212dfaee90ca0f43", "scanner": "scanner-primary", "fingerprint": "688648ec21c7285f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15284"]}}, {"ruleId": "scanner-e5c9c7a2ac4eee96", "level": "warning", "message": {"text": "CVE-2026-82417: qs 6.11.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "a7f7ddde050b0bff", "scanner": "scanner-primary", "fingerprint": "e5c9c7a2ac4eee96", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82417"]}}, {"ruleId": "scanner-d1770f81aa9e98fe", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.11.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "9874f96ea2c6eb3f", "scanner": "scanner-primary", "fingerprint": "d1770f81aa9e98fe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-09aa358d2e367503", "level": "note", "message": {"text": "CVE-2026-2391: qs 6.11.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "5828ea7bea940935", "scanner": "scanner-primary", "fingerprint": "09aa358d2e367503", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2391"]}}, {"ruleId": "scanner-63d7b9a9c2bc39e8", "level": "warning", "message": {"text": "CVE-2025-15284: qs 6.5.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "212dfaee90ca0f43", "scanner": "scanner-primary", "fingerprint": "63d7b9a9c2bc39e8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15284"]}}, {"ruleId": "scanner-6163ef8b2dafc4a7", "level": "warning", "message": {"text": "CVE-2026-82417: qs 6.5.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "a7f7ddde050b0bff", "scanner": "scanner-primary", "fingerprint": "6163ef8b2dafc4a7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82417"]}}, {"ruleId": "scanner-0116a8aecb6cc84f", "level": "warning", "message": {"text": "CVE-2023-28155: request 2.88.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "cc07fab219511a78", "scanner": "scanner-primary", "fingerprint": "0116a8aecb6cc84f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-28155"]}}, {"ruleId": "scanner-844a9decbf372f9e", "level": "error", "message": {"text": "CVE-2022-25883: semver 6.3.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "763ea65a27b03cec", "scanner": "scanner-primary", "fingerprint": "844a9decbf372f9e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-25883"]}}, {"ruleId": "scanner-9dbab1111c2e120b", "level": "error", "message": {"text": "CVE-2022-25883: semver 7.5.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "763ea65a27b03cec", "scanner": "scanner-primary", "fingerprint": "9dbab1111c2e120b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2022-25883"]}}, {"ruleId": "scanner-d371c9eded98dda0", "level": "note", "message": {"text": "CVE-2024-43799: send 0.18.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "9ad60869c5fe61a5", "scanner": "scanner-primary", "fingerprint": "d371c9eded98dda0", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-43799"]}}, {"ruleId": "scanner-1b4d31608e575af1", "level": "error", "message": {"text": "CVE-2026-69240: sequelize 6.31.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "a2a95ae5fff8c3d9", "scanner": "scanner-primary", "fingerprint": "1b4d31608e575af1", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69240"]}}, {"ruleId": "scanner-76d0feefa2c218ff", "level": "error", "message": {"text": "CVE-2026-30951: sequelize 6.31.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "376eac6c62de458d", "scanner": "scanner-primary", "fingerprint": "76d0feefa2c218ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-30951"]}}, {"ruleId": "scanner-74773e7b700664f1", "level": "note", "message": {"text": "CVE-2024-43800: serve-static 1.15.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "c299382968c0c33d", "scanner": "scanner-primary", "fingerprint": "74773e7b700664f1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-43800"]}}, {"ruleId": "scanner-591a9ee8c8c839c0", "level": "warning", "message": {"text": "CVE-2024-38355: socket.io 4.6.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "a7aa9fe358e3fa5c", "scanner": "scanner-primary", "fingerprint": "591a9ee8c8c839c0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-38355"]}}, {"ruleId": "scanner-0c8d2e9cb4f2ecc1", "level": "error", "message": {"text": "CVE-2026-33151: socket.io-parser 4.2.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "cd5cea1811c7c1a9", "scanner": "scanner-primary", "fingerprint": "0c8d2e9cb4f2ecc1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33151"]}}, {"ruleId": "scanner-a7919e3f1c818389", "level": "error", "message": {"text": "CVE-2026-69185: socket.io-parser 4.2.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "33f93fc0bd7e17a9", "scanner": "scanner-primary", "fingerprint": "a7919e3f1c818389", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69185"]}}, {"ruleId": "scanner-cfe805a6ec328ed4", "level": "warning", "message": {"text": "CVE-2023-32695: socket.io-parser 4.2.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "f80392c82570979a", "scanner": "scanner-primary", "fingerprint": "cfe805a6ec328ed4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-32695"]}}, {"ruleId": "scanner-43e671add7c17f96", "level": "error", "message": {"text": "CVE-2026-59873: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "f8005d18db55f8c6", "scanner": "scanner-primary", "fingerprint": "43e671add7c17f96", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59873"]}}, {"ruleId": "scanner-053c6539aba51a80", "level": "error", "message": {"text": "CVE-2026-23745: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "6e99379be8786c50", "scanner": "scanner-primary", "fingerprint": "053c6539aba51a80", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23745"]}}, {"ruleId": "scanner-01ef74fede9d0ef9", "level": "error", "message": {"text": "CVE-2026-23950: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "1cff0e6c3c08864f", "scanner": "scanner-primary", "fingerprint": "01ef74fede9d0ef9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23950"]}}, {"ruleId": "scanner-afd6ae624c1186f1", "level": "error", "message": {"text": "CVE-2026-24842: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "947ccc008e682b3d", "scanner": "scanner-primary", "fingerprint": "afd6ae624c1186f1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24842"]}}, {"ruleId": "scanner-e64fc0b3363ab97f", "level": "error", "message": {"text": "CVE-2026-26960: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "1baa24849c5270af", "scanner": "scanner-primary", "fingerprint": "e64fc0b3363ab97f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26960"]}}, {"ruleId": "scanner-a69d4f8e442fb135", "level": "error", "message": {"text": "CVE-2026-29786: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "58b354cc21e27709", "scanner": "scanner-primary", "fingerprint": "a69d4f8e442fb135", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29786"]}}, {"ruleId": "scanner-de3bf737074351fe", "level": "error", "message": {"text": "CVE-2026-31802: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "a06984e9d4398fb9", "scanner": "scanner-primary", "fingerprint": "de3bf737074351fe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31802"]}}, {"ruleId": "scanner-24874044eac61749", "level": "error", "message": {"text": "CVE-2026-59874: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "fddc56fd8c1ccee1", "scanner": "scanner-primary", "fingerprint": "24874044eac61749", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59874"]}}, {"ruleId": "scanner-82f95adceb6838dd", "level": "error", "message": {"text": "CVE-2026-73566: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "333161ba765a2c6c", "scanner": "scanner-primary", "fingerprint": "82f95adceb6838dd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73566"]}}, {"ruleId": "scanner-062547f4c2e3e3e6", "level": "warning", "message": {"text": "CVE-2024-28863: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "33f59a503e3098bc", "scanner": "scanner-primary", "fingerprint": "062547f4c2e3e3e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-28863"]}}, {"ruleId": "scanner-4a1879fad677e51b", "level": "warning", "message": {"text": "CVE-2026-53655: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "6e1ef9fe4f929ca6", "scanner": "scanner-primary", "fingerprint": "4a1879fad677e51b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53655"]}}, {"ruleId": "scanner-053125a2cddb78b2", "level": "warning", "message": {"text": "CVE-2026-59871: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "abf2469fa8d31cf9", "scanner": "scanner-primary", "fingerprint": "053125a2cddb78b2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59871"]}}, {"ruleId": "scanner-a8855c0ab3691e86", "level": "warning", "message": {"text": "CVE-2026-59875: tar 6.1.13 \u2014 package-lock.json"}, "properties": {"repobilityId": "367157b3e8827ec8", "scanner": "scanner-primary", "fingerprint": "a8855c0ab3691e86", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59875"]}}, {"ruleId": "scanner-1fb15454391d0e2d", "level": "warning", "message": {"text": "CVE-2023-26136: tough-cookie 2.5.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "95d56a6e82acf574", "scanner": "scanner-primary", "fingerprint": "1fb15454391d0e2d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-26136"]}}, {"ruleId": "scanner-a49444de561c5107", "level": "error", "message": {"text": "CVE-2026-27601: underscore 1.13.6 \u2014 package-lock.json"}, "properties": {"repobilityId": "12544e905a91e5d5", "scanner": "scanner-primary", "fingerprint": "a49444de561c5107", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27601"]}}, {"ruleId": "scanner-002a799a6b092d13", "level": "error", "message": {"text": "CVE-2026-12151: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "99c415fea2a5f85c", "scanner": "scanner-primary", "fingerprint": "002a799a6b092d13", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12151"]}}, {"ruleId": "scanner-190a59bed67cb755", "level": "error", "message": {"text": "CVE-2026-1526: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "4c3f3677e1b89ca5", "scanner": "scanner-primary", "fingerprint": "190a59bed67cb755", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1526"]}}, {"ruleId": "scanner-da17510701954f01", "level": "error", "message": {"text": "CVE-2026-2229: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "9c2610ae57d2db62", "scanner": "scanner-primary", "fingerprint": "da17510701954f01", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2229"]}}, {"ruleId": "scanner-61d438c03672d7a0", "level": "warning", "message": {"text": "CVE-2025-22150: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "aca41462afc8bc1f", "scanner": "scanner-primary", "fingerprint": "61d438c03672d7a0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-22150"]}}, {"ruleId": "scanner-8f0b1e810aa4fd60", "level": "warning", "message": {"text": "CVE-2026-15157: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "be1bbe0ec75d95ff", "scanner": "scanner-primary", "fingerprint": "8f0b1e810aa4fd60", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-15157"]}}, {"ruleId": "scanner-d9421a0aa379bdcb", "level": "warning", "message": {"text": "CVE-2026-1525: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "a568b02bb57f57d9", "scanner": "scanner-primary", "fingerprint": "d9421a0aa379bdcb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1525"]}}, {"ruleId": "scanner-a2ccefce1dd565c7", "level": "warning", "message": {"text": "CVE-2026-1527: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "a733ed916ee3efd8", "scanner": "scanner-primary", "fingerprint": "a2ccefce1dd565c7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-1527"]}}, {"ruleId": "scanner-c0a59752940db46c", "level": "warning", "message": {"text": "CVE-2026-16728: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "40ef9db8c48f9db3", "scanner": "scanner-primary", "fingerprint": "c0a59752940db46c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16728"]}}, {"ruleId": "scanner-0f33d9a3c04c8931", "level": "warning", "message": {"text": "CVE-2026-16729: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "803ad903f5176f77", "scanner": "scanner-primary", "fingerprint": "0f33d9a3c04c8931", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16729"]}}, {"ruleId": "scanner-b7368eef75449588", "level": "warning", "message": {"text": "CVE-2026-22036: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "bbecb1155de1de5e", "scanner": "scanner-primary", "fingerprint": "b7368eef75449588", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22036"]}}, {"ruleId": "scanner-afdebcb2f092158b", "level": "warning", "message": {"text": "CVE-2026-9679: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "4615f8d61406dccb", "scanner": "scanner-primary", "fingerprint": "afdebcb2f092158b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9679"]}}, {"ruleId": "scanner-e4936f3ccbedce54", "level": "note", "message": {"text": "CVE-2023-45143: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "c3907ac1c9f1757d", "scanner": "scanner-primary", "fingerprint": "e4936f3ccbedce54", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2023-45143"]}}, {"ruleId": "scanner-013ca009d7190a81", "level": "note", "message": {"text": "CVE-2024-24758: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "2c87ce355af75520", "scanner": "scanner-primary", "fingerprint": "013ca009d7190a81", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-24758"]}}, {"ruleId": "scanner-485ee74df32760d5", "level": "note", "message": {"text": "CVE-2024-30260: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "67ee01a98ccb4ca2", "scanner": "scanner-primary", "fingerprint": "485ee74df32760d5", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-30260"]}}, {"ruleId": "scanner-ac83769f202fbdce", "level": "note", "message": {"text": "CVE-2024-30261: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "48eccd272abbc84d", "scanner": "scanner-primary", "fingerprint": "ac83769f202fbdce", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-30261"]}}, {"ruleId": "scanner-d0a25472dd19f74a", "level": "note", "message": {"text": "CVE-2025-47279: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "67a0c875969646a2", "scanner": "scanner-primary", "fingerprint": "d0a25472dd19f74a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-47279"]}}, {"ruleId": "scanner-838d9d1a05d5420d", "level": "note", "message": {"text": "CVE-2026-11525: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "4a99f39de3f3b456", "scanner": "scanner-primary", "fingerprint": "838d9d1a05d5420d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-11525"]}}, {"ruleId": "scanner-e70fd30e837598d7", "level": "note", "message": {"text": "CVE-2026-6733: undici 5.25.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "ea5eccab85d6eb97", "scanner": "scanner-primary", "fingerprint": "e70fd30e837598d7", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6733"]}}, {"ruleId": "scanner-69408c2d566dfc6b", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 3.4.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "456116cfa0f62296", "scanner": "scanner-primary", "fingerprint": "69408c2d566dfc6b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-4739f516a66919b1", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 8.3.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "456116cfa0f62296", "scanner": "scanner-primary", "fingerprint": "4739f516a66919b1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-c1ac7214f5835197", "level": "error", "message": {"text": "CVE-2025-12758: validator 13.9.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "0049f1301efd268e", "scanner": "scanner-primary", "fingerprint": "c1ac7214f5835197", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-12758"]}}, {"ruleId": "scanner-fa8f585374f0d31b", "level": "warning", "message": {"text": "CVE-2025-56200: validator 13.9.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "63cd97ce2b88ce26", "scanner": "scanner-primary", "fingerprint": "fa8f585374f0d31b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-56200"]}}, {"ruleId": "scanner-84bd70cad5df019f", "level": "error", "message": {"text": "CVE-2024-37890: ws 3.3.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "22404954a8a825ae", "scanner": "scanner-primary", "fingerprint": "84bd70cad5df019f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-37890"]}}, {"ruleId": "scanner-f4d21334e5163f58", "level": "error", "message": {"text": "CVE-2026-48779: ws 3.3.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "f7e31279300ec7e6", "scanner": "scanner-primary", "fingerprint": "f4d21334e5163f58", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-16b8342bb7d78b20", "level": "error", "message": {"text": "CVE-2024-37890: ws 7.5.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "22404954a8a825ae", "scanner": "scanner-primary", "fingerprint": "16b8342bb7d78b20", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-37890"]}}, {"ruleId": "scanner-bad528e6ad0b27f0", "level": "error", "message": {"text": "CVE-2026-48779: ws 7.5.9 \u2014 package-lock.json"}, "properties": {"repobilityId": "f7e31279300ec7e6", "scanner": "scanner-primary", "fingerprint": "bad528e6ad0b27f0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-eedb848ae31df6ce", "level": "error", "message": {"text": "CVE-2024-37890: ws 8.11.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "22404954a8a825ae", "scanner": "scanner-primary", "fingerprint": "eedb848ae31df6ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-37890"]}}, {"ruleId": "scanner-332ab96967dd5e06", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.11.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "f7e31279300ec7e6", "scanner": "scanner-primary", "fingerprint": "332ab96967dd5e06", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-ec755e3947680196", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.11.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "7635a49db32e4699", "scanner": "scanner-primary", "fingerprint": "ec755e3947680196", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-bc79fd8953c6e35d", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in Goat.js:27"}, "properties": {"repobilityId": "48b1cf4582269c63", "scanner": "scanner-primary", "fingerprint": "bc79fd8953c6e35d", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Goat.js"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-ea5b86173718ea3a", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in index.js:20"}, "properties": {"repobilityId": "3708f9863101c933", "scanner": "scanner-primary", "fingerprint": "ea5b86173718ea3a", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.js"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-60afbf3fcf4b744b", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in update.js:4"}, "properties": {"repobilityId": "8e2f3e619158371c", "scanner": "scanner-primary", "fingerprint": "60afbf3fcf4b744b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "update.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-3b605d13c341512b", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in bot/login/loginMbasic.js:1"}, "properties": {"repobilityId": "23dcd8432e346184", "scanner": "scanner-primary", "fingerprint": "3b605d13c341512b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bot/login/loginMbasic.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce4390c82e527adf", "level": "error", "message": {"text": "Possible secret in scripts/cmds/weather.js"}, "properties": {"repobilityId": "6c3ff15f2cdf7944", "scanner": "scanner-primary", "fingerprint": "ce4390c82e527adf", "layer": "security", "severity": "high", "confidence": 0.72, "tags": ["secrets", "generic_api_key"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cmds/weather.js"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-613a7568616d29b2", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in scripts/cmds/eval.js:72"}, "properties": {"repobilityId": "debf76012a6a69a7", "scanner": "scanner-primary", "fingerprint": "613a7568616d29b2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cmds/eval.js"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-3bbcd5c227c28eb4", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in scripts/cmds/cmd.js:2"}, "properties": {"repobilityId": "2ae13c957cb1a4b4", "scanner": "scanner-primary", "fingerprint": "3bbcd5c227c28eb4", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cmds/cmd.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-34d23473aec2b2f8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/preview-modal.js:4"}, "properties": {"repobilityId": "11d4f4b90dd41b78", "scanner": "scanner-primary", "fingerprint": "34d23473aec2b2f8", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/js/preview-modal.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-c35a52bca573c9ab", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/toast.js:43"}, "properties": {"repobilityId": "1210d019366e0197", "scanner": "scanner-primary", "fingerprint": "c35a52bca573c9ab", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/js/toast.js"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-450e3ea33203faa8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/bootstrap.bundle.min.js:3049"}, "properties": {"repobilityId": "ba2385e5a540e18e", "scanner": "scanner-primary", "fingerprint": "450e3ea33203faa8", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/js/bootstrap.bundle.min.js"}, "region": {"startLine": 3049}}}]}, {"ruleId": "scanner-c7bb71df81fed2f0", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in dashboard/js/bootstrap.bundle.min.js:3078"}, "properties": {"repobilityId": "3ea73a8e7ef3cfd6", "scanner": "scanner-primary", "fingerprint": "c7bb71df81fed2f0", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/js/bootstrap.bundle.min.js"}, "region": {"startLine": 3078}}}]}, {"ruleId": "scanner-ccb40916078d3b37", "level": "note", "message": {"text": "Very large file: dashboard/js/phoenix.js (4956 lines)"}, "properties": {"repobilityId": "394e8e1daa9f723b", "scanner": "scanner-primary", "fingerprint": "ccb40916078d3b37", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bbc839136c32b937", "level": "note", "message": {"text": "Very large file: dashboard/js/bootstrap.bundle.min.js (3965 lines)"}, "properties": {"repobilityId": "fdc8d7b544a61114", "scanner": "scanner-primary", "fingerprint": "bbc839136c32b937", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "31871b6a833fd51c", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "aaee4171f501c4c6", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "ec2fc6df17d80c24", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-9c9cb2c1ecc7d978", "level": "none", "message": {"text": "Commented-code block (5 lines) in bot/login/login.js:988"}, "properties": {"repobilityId": "9ace6cd499f9c329", "scanner": "scanner-primary", "fingerprint": "9c9cb2c1ecc7d978", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bot/login/login.js"}, "region": {"startLine": 988}}}]}, {"ruleId": "scanner-a0ad6f582bfd4ba2", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/cmds/ytb.js:269"}, "properties": {"repobilityId": "0b20524467819ac3", "scanner": "scanner-primary", "fingerprint": "a0ad6f582bfd4ba2", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cmds/ytb.js"}, "region": {"startLine": 269}}}]}, {"ruleId": "scanner-2757c49ada0f8d90", "level": "none", "message": {"text": "Commented-code block (6 lines) in dashboard/routes/api.js:344"}, "properties": {"repobilityId": "674b19e7dcea358e", "scanner": "scanner-primary", "fingerprint": "2757c49ada0f8d90", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/routes/api.js"}, "region": {"startLine": 344}}}]}, {"ruleId": "scanner-cf6303d0149baa9a", "level": "none", "message": {"text": "Commented-code block (6 lines) in fb-chat-api/utils.js:1127"}, "properties": {"repobilityId": "0e2241cf4d4cf046", "scanner": "scanner-primary", "fingerprint": "cf6303d0149baa9a", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fb-chat-api/utils.js"}, "region": {"startLine": 1127}}}]}, {"ruleId": "scanner-6b3dcdb23b4c0c18", "level": "note", "message": {"text": "Legacy-named symbol `jewel_requests_remove_old` in fb-chat-api/src/listenMqtt.js:200"}, "properties": {"repobilityId": "e4ae879d7360a325", "scanner": "scanner-primary", "fingerprint": "6b3dcdb23b4c0c18", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7a4af9d8ffc71abb", "level": "none", "message": {"text": "Commented-code block (12 lines) in fb-chat-api/src/listenMqtt.js:753"}, "properties": {"repobilityId": "a105c51797635bd7", "scanner": "scanner-primary", "fingerprint": "7a4af9d8ffc71abb", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fb-chat-api/src/listenMqtt.js"}, "region": {"startLine": 753}}}]}, {"ruleId": "scanner-9554c34a61fcb264", "level": "error", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-3g43-6gmg-66jw"}, "properties": {"repobilityId": "3579ba70ebc2910e", "scanner": "scanner-primary", "fingerprint": "9554c34a61fcb264", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3g43-6gmg-66jw", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f57b08dbe2e62da", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-3p68-rc4w-qgx5"}, "properties": {"repobilityId": "37f05a1e1fb62290", "scanner": "scanner-primary", "fingerprint": "8f57b08dbe2e62da", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3p68-rc4w-qgx5", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2d79c74a7d8cdb1", "level": "error", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-43fc-jf86-j433"}, "properties": {"repobilityId": "d4a68fd0de3c75d3", "scanner": "scanner-primary", "fingerprint": "a2d79c74a7d8cdb1", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-43fc-jf86-j433", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c00bbabb4e620fc8", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-5c9x-8gcm-mpgx"}, "properties": {"repobilityId": "dd5c49afed61fb1b", "scanner": "scanner-primary", "fingerprint": "c00bbabb4e620fc8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5c9x-8gcm-mpgx", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f24505be1f3fbdb", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-62hf-57xw-28j9"}, "properties": {"repobilityId": "0b69677a5bd11cf5", "scanner": "scanner-primary", "fingerprint": "6f24505be1f3fbdb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-62hf-57xw-28j9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce4a060cd875bcc8", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-6chq-wfr3-2hj9"}, "properties": {"repobilityId": "bea3e6a1625a17cd", "scanner": "scanner-primary", "fingerprint": "ce4a060cd875bcc8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6chq-wfr3-2hj9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67699ceea4353071", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-7q8q-rj6j-mhjq"}, "properties": {"repobilityId": "1108dcee9278dcde", "scanner": "scanner-primary", "fingerprint": "67699ceea4353071", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7q8q-rj6j-mhjq", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e36062f31ad7c38", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-898c-q2cr-xwhg"}, "properties": {"repobilityId": "633ebdf9485064f8", "scanner": "scanner-primary", "fingerprint": "0e36062f31ad7c38", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-898c-q2cr-xwhg", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-20a326d40367bdc4", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-fvcv-3m26-pcqx"}, "properties": {"repobilityId": "d5e350e9f991a466", "scanner": "scanner-primary", "fingerprint": "20a326d40367bdc4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fvcv-3m26-pcqx", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3859ebc824631787", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-hfxv-24rg-xrqf"}, "properties": {"repobilityId": "c33eb563d22467a7", "scanner": "scanner-primary", "fingerprint": "3859ebc824631787", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hfxv-24rg-xrqf", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ccb5ea8a6ba5f57", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-j5f8-grm9-p9fc"}, "properties": {"repobilityId": "03f25f4986a4e144", "scanner": "scanner-primary", "fingerprint": "6ccb5ea8a6ba5f57", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-j5f8-grm9-p9fc", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8903888e2838f9a", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-jr5f-v2jv-69x6"}, "properties": {"repobilityId": "e1e9de8f9baba12b", "scanner": "scanner-primary", "fingerprint": "a8903888e2838f9a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jr5f-v2jv-69x6", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8367d7a4e1586b11", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-m7pr-hjqh-92cm"}, "properties": {"repobilityId": "1536989941527937", "scanner": "scanner-primary", "fingerprint": "8367d7a4e1586b11", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-m7pr-hjqh-92cm", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f071312cd8b9ea4", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-mmx7-hfxf-jppx"}, "properties": {"repobilityId": "fe36a4cb2bccf279", "scanner": "scanner-primary", "fingerprint": "8f071312cd8b9ea4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mmx7-hfxf-jppx", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6dea7b1d802d614d", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-p92q-9vqr-4j8v"}, "properties": {"repobilityId": "a66e4b4c1d1690aa", "scanner": "scanner-primary", "fingerprint": "6dea7b1d802d614d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p92q-9vqr-4j8v", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-969b9bd2b2dce504", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-pf86-5x62-jrwf"}, "properties": {"repobilityId": "1aa8abb7cd111314", "scanner": "scanner-primary", "fingerprint": "969b9bd2b2dce504", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-pf86-5x62-jrwf", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4224eb960b4131e7", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-pjwm-pj3p-43mv"}, "properties": {"repobilityId": "17de050d40a581a9", "scanner": "scanner-primary", "fingerprint": "4224eb960b4131e7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-pjwm-pj3p-43mv", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c263302b073a59f", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-pmwg-cvhr-8vh7"}, "properties": {"repobilityId": "19c456ea085ae52c", "scanner": "scanner-primary", "fingerprint": "4c263302b073a59f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-pmwg-cvhr-8vh7", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c2b95ee2f96eb781", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-vf2m-468p-8v99"}, "properties": {"repobilityId": "73df0509f108b83a", "scanner": "scanner-primary", "fingerprint": "c2b95ee2f96eb781", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vf2m-468p-8v99", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ad854b7f62f8902", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-w9j2-pvgh-6h63"}, "properties": {"repobilityId": "ce39efb58e8ffdc3", "scanner": "scanner-primary", "fingerprint": "8ad854b7f62f8902", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w9j2-pvgh-6h63", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e79f4d85166e9ecd", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-wf5p-g6vw-rhxx"}, "properties": {"repobilityId": "e533189d7ca1de15", "scanner": "scanner-primary", "fingerprint": "e79f4d85166e9ecd", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wf5p-g6vw-rhxx", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c943281731d4287", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-xhjh-pmcv-23jw"}, "properties": {"repobilityId": "79a689c1ef504d47", "scanner": "scanner-primary", "fingerprint": "5c943281731d4287", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xhjh-pmcv-23jw", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2269d9a59a660ecc", "level": "warning", "message": {"text": "Vulnerable dependency axios 0.21.4: GHSA-xx6v-rp6x-q39c"}, "properties": {"repobilityId": "3657a4dbc48fd50a", "scanner": "scanner-primary", "fingerprint": "2269d9a59a660ecc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xx6v-rp6x-q39c", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-405353e94f2520a7", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-35jp-ww65-95wh"}, "properties": {"repobilityId": "a3e4b50e0aba7152", "scanner": "scanner-primary", "fingerprint": "405353e94f2520a7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-35jp-ww65-95wh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7bac8b28408d093", "level": "error", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-3g43-6gmg-66jw"}, "properties": {"repobilityId": "293a0c2fa7b4109a", "scanner": "scanner-primary", "fingerprint": "d7bac8b28408d093", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3g43-6gmg-66jw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-94c4c7fa5a8f6033", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-3p68-rc4w-qgx5"}, "properties": {"repobilityId": "a27c96fdf4dca8e6", "scanner": "scanner-primary", "fingerprint": "94c4c7fa5a8f6033", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3p68-rc4w-qgx5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f118b5be6f416a7", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-3w6x-2g7m-8v23"}, "properties": {"repobilityId": "7a382b8af2144262", "scanner": "scanner-primary", "fingerprint": "9f118b5be6f416a7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3w6x-2g7m-8v23"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-21cf1a60579ddae5", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-42h9-826w-cgv3"}, "properties": {"repobilityId": "f1b39093e06eea04", "scanner": "scanner-primary", "fingerprint": "21cf1a60579ddae5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-42h9-826w-cgv3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cbac9f97b18fa7d6", "level": "error", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-43fc-jf86-j433"}, "properties": {"repobilityId": "c4a7c59a11da158e", "scanner": "scanner-primary", "fingerprint": "cbac9f97b18fa7d6", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-43fc-jf86-j433"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-206d37a21d3b1c9e", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-445q-vr5w-6q77"}, "properties": {"repobilityId": "3e41325c33d02669", "scanner": "scanner-primary", "fingerprint": "206d37a21d3b1c9e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-445q-vr5w-6q77"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-12288acdfa3464bf", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-4hjh-wcwx-xvwj"}, "properties": {"repobilityId": "e43257b0ee8c675e", "scanner": "scanner-primary", "fingerprint": "12288acdfa3464bf", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4hjh-wcwx-xvwj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-14364ebbd0d3bd49", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-5c9x-8gcm-mpgx"}, "properties": {"repobilityId": "3a03cb518fa1aeee", "scanner": "scanner-primary", "fingerprint": "14364ebbd0d3bd49", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5c9x-8gcm-mpgx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7cc1e95bb4f29406", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-62hf-57xw-28j9"}, "properties": {"repobilityId": "67a70dbbabc5aad9", "scanner": "scanner-primary", "fingerprint": "7cc1e95bb4f29406", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-62hf-57xw-28j9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df56d39a28c64f33", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-6chq-wfr3-2hj9"}, "properties": {"repobilityId": "9697435195856e99", "scanner": "scanner-primary", "fingerprint": "df56d39a28c64f33", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6chq-wfr3-2hj9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-baf02b0bb8366924", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-7q8q-rj6j-mhjq"}, "properties": {"repobilityId": "3f384d2d1d14a812", "scanner": "scanner-primary", "fingerprint": "baf02b0bb8366924", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7q8q-rj6j-mhjq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ee66d914310429c", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-898c-q2cr-xwhg"}, "properties": {"repobilityId": "c44ddc97a2e650a1", "scanner": "scanner-primary", "fingerprint": "9ee66d914310429c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-898c-q2cr-xwhg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58d87c9e9172d2f9", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-8hc4-vh64-cxmj"}, "properties": {"repobilityId": "45c1d188edb1124d", "scanner": "scanner-primary", "fingerprint": "58d87c9e9172d2f9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8hc4-vh64-cxmj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0e22f3286f65194", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-fvcv-3m26-pcqx"}, "properties": {"repobilityId": "fb84ca21d0bef330", "scanner": "scanner-primary", "fingerprint": "b0e22f3286f65194", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fvcv-3m26-pcqx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-384056bb6124e22f", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-hfxv-24rg-xrqf"}, "properties": {"repobilityId": "2743d301fe302946", "scanner": "scanner-primary", "fingerprint": "384056bb6124e22f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hfxv-24rg-xrqf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9df9ede97a54a8d", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-j5f8-grm9-p9fc"}, "properties": {"repobilityId": "5bd13c5315bae52d", "scanner": "scanner-primary", "fingerprint": "d9df9ede97a54a8d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j5f8-grm9-p9fc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a832ca1fe29f6b19", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-jr5f-v2jv-69x6"}, "properties": {"repobilityId": "1917732442f8bc38", "scanner": "scanner-primary", "fingerprint": "a832ca1fe29f6b19", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jr5f-v2jv-69x6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-932ba10a7ff362bf", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-m7pr-hjqh-92cm"}, "properties": {"repobilityId": "22af3d4ee86406be", "scanner": "scanner-primary", "fingerprint": "932ba10a7ff362bf", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m7pr-hjqh-92cm"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-93ede8c7c8cdb53d", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-mmx7-hfxf-jppx"}, "properties": {"repobilityId": "ec148c1188673f5e", "scanner": "scanner-primary", "fingerprint": "93ede8c7c8cdb53d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mmx7-hfxf-jppx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-22ffa70365ae1da3", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-p92q-9vqr-4j8v"}, "properties": {"repobilityId": "045cb1ecabee9b08", "scanner": "scanner-primary", "fingerprint": "22ffa70365ae1da3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p92q-9vqr-4j8v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb048a0c318b79eb", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-pf86-5x62-jrwf"}, "properties": {"repobilityId": "8c32b4936b377948", "scanner": "scanner-primary", "fingerprint": "cb048a0c318b79eb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pf86-5x62-jrwf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f1493c190d69b6f", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-pmv8-rq9r-6j72"}, "properties": {"repobilityId": "61f6be17cc73b2b0", "scanner": "scanner-primary", "fingerprint": "1f1493c190d69b6f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pmv8-rq9r-6j72"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17bbd6174410d007", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-pmwg-cvhr-8vh7"}, "properties": {"repobilityId": "73c8662057fcddce", "scanner": "scanner-primary", "fingerprint": "17bbd6174410d007", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pmwg-cvhr-8vh7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d516a0366a3360bc", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-q8qp-cvcw-x6jj"}, "properties": {"repobilityId": "067db882973fa7f6", "scanner": "scanner-primary", "fingerprint": "d516a0366a3360bc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q8qp-cvcw-x6jj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-033867c335f1e0d0", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-vf2m-468p-8v99"}, "properties": {"repobilityId": "fc1027572350b1e4", "scanner": "scanner-primary", "fingerprint": "033867c335f1e0d0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vf2m-468p-8v99"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9bb8c5e446989264", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-w9j2-pvgh-6h63"}, "properties": {"repobilityId": "01a6ad05b0682904", "scanner": "scanner-primary", "fingerprint": "9bb8c5e446989264", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w9j2-pvgh-6h63"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8444573eb9d5a6f3", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-wf5p-g6vw-rhxx"}, "properties": {"repobilityId": "e699416e69697679", "scanner": "scanner-primary", "fingerprint": "8444573eb9d5a6f3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wf5p-g6vw-rhxx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc86a42eba0753fe", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-xhjh-pmcv-23jw"}, "properties": {"repobilityId": "da8b85ff7636df09", "scanner": "scanner-primary", "fingerprint": "bc86a42eba0753fe", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xhjh-pmcv-23jw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-573a612daeefb8a1", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.4.0: GHSA-xx6v-rp6x-q39c"}, "properties": {"repobilityId": "1c8757734b3a4c80", "scanner": "scanner-primary", "fingerprint": "573a612daeefb8a1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xx6v-rp6x-q39c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-38b49ee09735f994", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.11.0: GHSA-4mjr-xmp4-gh2g"}, "properties": {"repobilityId": "3d2cd8578e30476a", "scanner": "scanner-primary", "fingerprint": "38b49ee09735f994", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4mjr-xmp4-gh2g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d255c092d51fd80", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.11.0: GHSA-6rw7-vpxm-498p"}, "properties": {"repobilityId": "eafd03e6dd1118e4", "scanner": "scanner-primary", "fingerprint": "2d255c092d51fd80", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6rw7-vpxm-498p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f3e9fa879d9618b", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.11.0: GHSA-w7fw-mjwx-w883"}, "properties": {"repobilityId": "462584f196bc70dd", "scanner": "scanner-primary", "fingerprint": "7f3e9fa879d9618b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w7fw-mjwx-w883"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd3b18c468a2fa1e", "level": "warning", "message": {"text": "Vulnerable dependency eta 1.12.3: GHSA-mf6x-hrgr-658f"}, "properties": {"repobilityId": "e7070612da865495", "scanner": "scanner-primary", "fingerprint": "dd3b18c468a2fa1e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mf6x-hrgr-658f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a591c7cc9aee6440", "level": "warning", "message": {"text": "Vulnerable dependency eta 1.12.3: GHSA-xrh7-m5pp-39r6"}, "properties": {"repobilityId": "e5e03c6b2f4d0e53", "scanner": "scanner-primary", "fingerprint": "a591c7cc9aee6440", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xrh7-m5pp-39r6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-39d710c4d56d5add", "level": "warning", "message": {"text": "Vulnerable dependency express 4.18.2: GHSA-qw6h-vgh9-j6wx"}, "properties": {"repobilityId": "ba7e3612982818af", "scanner": "scanner-primary", "fingerprint": "39d710c4d56d5add", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qw6h-vgh9-j6wx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87c927c4198b7027", "level": "warning", "message": {"text": "Vulnerable dependency express 4.18.2: GHSA-rv95-896h-c2vc"}, "properties": {"repobilityId": "4b58c0ddd2f6e0f8", "scanner": "scanner-primary", "fingerprint": "87c927c4198b7027", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-rv95-896h-c2vc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a4869f69b341a430", "level": "warning", "message": {"text": "Vulnerable dependency form-data 4.0.0: GHSA-fjxv-7rqg-78g4"}, "properties": {"repobilityId": "7307811b60017fe3", "scanner": "scanner-primary", "fingerprint": "a4869f69b341a430", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fjxv-7rqg-78g4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f30e3601f0227298", "level": "warning", "message": {"text": "Vulnerable dependency form-data 4.0.0: GHSA-hmw2-7cc7-3qxx"}, "properties": {"repobilityId": "9c3a6da92cbc1d67", "scanner": "scanner-primary", "fingerprint": "f30e3601f0227298", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hmw2-7cc7-3qxx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1fd01aafb9e7484a", "level": "warning", "message": {"text": "Vulnerable dependency mongoose 6.10.5: GHSA-664h-wqgq-64gw"}, "properties": {"repobilityId": "5be4cc30bd4a8036", "scanner": "scanner-primary", "fingerprint": "1fd01aafb9e7484a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-664h-wqgq-64gw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c56e9052a05ff2e", "level": "warning", "message": {"text": "Vulnerable dependency mongoose 6.10.5: GHSA-9m93-w8w6-76hh"}, "properties": {"repobilityId": "2005f0b89bf4f500", "scanner": "scanner-primary", "fingerprint": "6c56e9052a05ff2e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-9m93-w8w6-76hh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c3f0d0b14a31554", "level": "warning", "message": {"text": "Vulnerable dependency mongoose 6.10.5: GHSA-m7xq-9374-9rvx"}, "properties": {"repobilityId": "929fda31dbbad894", "scanner": "scanner-primary", "fingerprint": "5c3f0d0b14a31554", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m7xq-9374-9rvx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5577b1c4239b9bf", "level": "warning", "message": {"text": "Vulnerable dependency mongoose 6.10.5: GHSA-vg7j-7cwx-8wgw"}, "properties": {"repobilityId": "2f19fd9c664661fd", "scanner": "scanner-primary", "fingerprint": "d5577b1c4239b9bf", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vg7j-7cwx-8wgw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4b9076f00d41bad8", "level": "warning", "message": {"text": "Vulnerable dependency mongoose 6.10.5: GHSA-wpg9-53fq-2r8h"}, "properties": {"repobilityId": "3cfd01fc31f463ca", "scanner": "scanner-primary", "fingerprint": "4b9076f00d41bad8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wpg9-53fq-2r8h"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b04592f6fa99a6cc", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-268h-hp4c-crq3"}, "properties": {"repobilityId": "ae3547e8cdb316ca", "scanner": "scanner-primary", "fingerprint": "b04592f6fa99a6cc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-268h-hp4c-crq3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83e4aa040c7aad6c", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-2x7j-588g-ccc2"}, "properties": {"repobilityId": "70315edad1d8865b", "scanner": "scanner-primary", "fingerprint": "83e4aa040c7aad6c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2x7j-588g-ccc2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-35ba5b03c1155f86", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-8m3c-c648-2xjj"}, "properties": {"repobilityId": "54d092584655827b", "scanner": "scanner-primary", "fingerprint": "35ba5b03c1155f86", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8m3c-c648-2xjj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-98045faadb659cc5", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-9h6g-pr28-7cqp"}, "properties": {"repobilityId": "dd84441cd00d5245", "scanner": "scanner-primary", "fingerprint": "98045faadb659cc5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-9h6g-pr28-7cqp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c9a96d539b7b25a", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-c7w3-x93f-qmm8"}, "properties": {"repobilityId": "627f5e424f690f04", "scanner": "scanner-primary", "fingerprint": "2c9a96d539b7b25a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-c7w3-x93f-qmm8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dfddde07a8392b3e", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-mm7p-fcc7-pg87"}, "properties": {"repobilityId": "6dc27faba325c89b", "scanner": "scanner-primary", "fingerprint": "dfddde07a8392b3e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mm7p-fcc7-pg87"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d77a5186669c4d74", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-p6gq-j5cr-w38f"}, "properties": {"repobilityId": "fc700b5e016b17f2", "scanner": "scanner-primary", "fingerprint": "d77a5186669c4d74", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p6gq-j5cr-w38f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f95b4f16619d9b9", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-r7g4-qg5f-qqm2"}, "properties": {"repobilityId": "dc6e57887da1c057", "scanner": "scanner-primary", "fingerprint": "3f95b4f16619d9b9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-r7g4-qg5f-qqm2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1fec71dab88340bc", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-rcmh-qjqh-p98v"}, "properties": {"repobilityId": "b69a0c8c2c5c1d46", "scanner": "scanner-primary", "fingerprint": "1fec71dab88340bc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-rcmh-qjqh-p98v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d28b8cd898a587c3", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-vvjj-xcjg-gr5g"}, "properties": {"repobilityId": "62fbc0567938407a", "scanner": "scanner-primary", "fingerprint": "d28b8cd898a587c3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vvjj-xcjg-gr5g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8098c57a1e14199a", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-wmmp-3585-3rmp"}, "properties": {"repobilityId": "8483dd16e30b6d74", "scanner": "scanner-primary", "fingerprint": "8098c57a1e14199a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wmmp-3585-3rmp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2f75533911536e66", "level": "warning", "message": {"text": "Vulnerable dependency nodemailer 6.9.1: GHSA-wqvq-jvpq-h66f"}, "properties": {"repobilityId": "1a6e615af1c2bd72", "scanner": "scanner-primary", "fingerprint": "2f75533911536e66", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wqvq-jvpq-h66f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-00ddf4f9ae31c007", "level": "warning", "message": {"text": "Vulnerable dependency pm2 5.3.0: GHSA-x5gf-qvw8-r2rm"}, "properties": {"repobilityId": "7b7b94bbb10beb40", "scanner": "scanner-primary", "fingerprint": "00ddf4f9ae31c007", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-x5gf-qvw8-r2rm", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8dde0900ad910280", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.11.1: GHSA-4mjr-xmp4-gh2g"}, "properties": {"repobilityId": "b696ce6e8d4efbcb", "scanner": "scanner-primary", "fingerprint": "8dde0900ad910280", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4mjr-xmp4-gh2g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-960cb74272eabbab", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.11.1: GHSA-6rw7-vpxm-498p"}, "properties": {"repobilityId": "16f675d3baa68dca", "scanner": "scanner-primary", "fingerprint": "960cb74272eabbab", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6rw7-vpxm-498p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f8647a404b227439", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.11.1: GHSA-q8mj-m7cp-5q26"}, "properties": {"repobilityId": "885df95aa08bca60", "scanner": "scanner-primary", "fingerprint": "f8647a404b227439", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q8mj-m7cp-5q26"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b82b3872406cffcb", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.11.1: GHSA-w7fw-mjwx-w883"}, "properties": {"repobilityId": "befd2f8dd985fa03", "scanner": "scanner-primary", "fingerprint": "b82b3872406cffcb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w7fw-mjwx-w883"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ebdf15169d9c4bba", "level": "warning", "message": {"text": "Vulnerable dependency request 2.88.2: GHSA-p8p7-x288-28g6"}, "properties": {"repobilityId": "6b6852c76a2eda2a", "scanner": "scanner-primary", "fingerprint": "ebdf15169d9c4bba", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p8p7-x288-28g6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-904de9b7ceb0ebde", "level": "warning", "message": {"text": "Vulnerable dependency form-data 2.3.3: GHSA-fjxv-7rqg-78g4"}, "properties": {"repobilityId": "01956c49a1e8bb07", "scanner": "scanner-primary", "fingerprint": "904de9b7ceb0ebde", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fjxv-7rqg-78g4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dddf616f81c2a473", "level": "warning", "message": {"text": "Vulnerable dependency form-data 2.3.3: GHSA-hmw2-7cc7-3qxx"}, "properties": {"repobilityId": "58963102c9e4b03a", "scanner": "scanner-primary", "fingerprint": "dddf616f81c2a473", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hmw2-7cc7-3qxx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce0be11d6b7aff0c", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.5.3: GHSA-4mjr-xmp4-gh2g"}, "properties": {"repobilityId": "101859505ea5f654", "scanner": "scanner-primary", "fingerprint": "ce0be11d6b7aff0c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4mjr-xmp4-gh2g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-058c00bf9ae58875", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.5.3: GHSA-6rw7-vpxm-498p"}, "properties": {"repobilityId": "324086e7b52c58b1", "scanner": "scanner-primary", "fingerprint": "058c00bf9ae58875", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6rw7-vpxm-498p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e48a2c1b496ecde6", "level": "warning", "message": {"text": "Vulnerable dependency sequelize 6.31.0: GHSA-6457-6jrx-69cr"}, "properties": {"repobilityId": "128c3578328c7bb2", "scanner": "scanner-primary", "fingerprint": "e48a2c1b496ecde6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6457-6jrx-69cr"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9a3934d7dae91f9b", "level": "warning", "message": {"text": "Vulnerable dependency sequelize 6.31.0: GHSA-v8fg-2rw7-q452"}, "properties": {"repobilityId": "92acb864ff15f4e7", "scanner": "scanner-primary", "fingerprint": "9a3934d7dae91f9b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-v8fg-2rw7-q452"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d17e0bb231af160", "level": "warning", "message": {"text": "Vulnerable dependency socket.io 4.6.1: GHSA-25hc-qcg6-38wj"}, "properties": {"repobilityId": "24f3ebb481cac91a", "scanner": "scanner-primary", "fingerprint": "2d17e0bb231af160", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-25hc-qcg6-38wj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d77988d1eac26d9", "level": "warning", "message": {"text": "Vulnerable dependency @babel/runtime 7.21.0: GHSA-968p-4wvh-cqc8"}, "properties": {"repobilityId": "dd445006bf356070", "scanner": "scanner-primary", "fingerprint": "5d77988d1eac26d9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-968p-4wvh-cqc8", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c10381a92f56358f", "level": "warning", "message": {"text": "Vulnerable dependency @babel/traverse 7.21.4: GHSA-67hx-6x53-jw92"}, "properties": {"repobilityId": "fb1378c18164ba60", "scanner": "scanner-primary", "fingerprint": "c10381a92f56358f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-67hx-6x53-jw92", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f63e7d78194b35d1", "level": "warning", "message": {"text": "Vulnerable dependency uuid 3.4.0: GHSA-w5hq-g745-h8pq"}, "properties": {"repobilityId": "44aa86fa02de8fa6", "scanner": "scanner-primary", "fingerprint": "f63e7d78194b35d1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w5hq-g745-h8pq", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da59fc3638e36a36", "level": "error", "message": {"text": "Vulnerable dependency ws 7.4.6: GHSA-3h5v-q93c-6h6q"}, "properties": {"repobilityId": "e8704ac5abb01a29", "scanner": "scanner-primary", "fingerprint": "da59fc3638e36a36", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3h5v-q93c-6h6q", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5d197e7ddf3179f", "level": "error", "message": {"text": "Vulnerable dependency ws 7.4.6: GHSA-96hv-2xvq-fx4p"}, "properties": {"repobilityId": "4b0856ee25cec075", "scanner": "scanner-primary", "fingerprint": "c5d197e7ddf3179f", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-96hv-2xvq-fx4p", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b63fbeac1812e847", "level": "error", "message": {"text": "Vulnerable dependency ws 7.5.9: GHSA-3h5v-q93c-6h6q"}, "properties": {"repobilityId": "7cfacbc9370acb5c", "scanner": "scanner-primary", "fingerprint": "b63fbeac1812e847", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3h5v-q93c-6h6q", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ea1eb4921da02c4", "level": "error", "message": {"text": "Vulnerable dependency ws 7.5.9: GHSA-96hv-2xvq-fx4p"}, "properties": {"repobilityId": "540cbde9601ddd32", "scanner": "scanner-primary", "fingerprint": "8ea1eb4921da02c4", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-96hv-2xvq-fx4p", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a595fb760c6d133e", "level": "warning", "message": {"text": "Vulnerable dependency @tootallnate/once 1.1.2: GHSA-vpq2-c234-7xj6"}, "properties": {"repobilityId": "dde2d5815aec1ff8", "scanner": "scanner-primary", "fingerprint": "a595fb760c6d133e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vpq2-c234-7xj6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1560d66bd60c2ad9", "level": "warning", "message": {"text": "Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6"}, "properties": {"repobilityId": "cf8ef5d83527dc1c", "scanner": "scanner-primary", "fingerprint": "1560d66bd60c2ad9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2g4f-4pwh-qvx6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ad9d975e1fa86b7", "level": "warning", "message": {"text": "Vulnerable dependency basic-ftp 5.0.4: GHSA-5rq4-664w-9x2c"}, "properties": {"repobilityId": "a8db6d0afb487099", "scanner": "scanner-primary", "fingerprint": "9ad9d975e1fa86b7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5rq4-664w-9x2c", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-927fe0422fc3a0e6", "level": "warning", "message": {"text": "Vulnerable dependency basic-ftp 5.0.4: GHSA-6v7q-wjvx-w8wg"}, "properties": {"repobilityId": "aed1be792002fb9a", "scanner": "scanner-primary", "fingerprint": "927fe0422fc3a0e6", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6v7q-wjvx-w8wg", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af3f2779dbc7573e", "level": "warning", "message": {"text": "Vulnerable dependency basic-ftp 5.0.4: GHSA-rp42-5vxx-qpwr"}, "properties": {"repobilityId": "bc90d0c851b1b9c2", "scanner": "scanner-primary", "fingerprint": "af3f2779dbc7573e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rp42-5vxx-qpwr", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1407ea0008f1600c", "level": "warning", "message": {"text": "Vulnerable dependency basic-ftp 5.0.4: GHSA-rpmf-866q-6p89"}, "properties": {"repobilityId": "1e146e272b32e0ab", "scanner": "scanner-primary", "fingerprint": "1407ea0008f1600c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rpmf-866q-6p89", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ceba42c14772bd4e", "level": "warning", "message": {"text": "Vulnerable dependency body-parser 1.20.1: GHSA-qwcr-r2fm-qrc7"}, "properties": {"repobilityId": "53bc96ad777cd241", "scanner": "scanner-primary", "fingerprint": "ceba42c14772bd4e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qwcr-r2fm-qrc7", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ee8436bcf200e43f", "level": "warning", "message": {"text": "Vulnerable dependency body-parser 1.20.1: GHSA-v422-hmwv-36x6"}, "properties": {"repobilityId": "8d054317825aae46", "scanner": "scanner-primary", "fingerprint": "ee8436bcf200e43f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v422-hmwv-36x6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-36f41499711b8115", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "550046966683e89f", "scanner": "scanner-primary", "fingerprint": "36f41499711b8115", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5de61c3cbb551dc", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-f886-m6hf-6m8v"}, "properties": {"repobilityId": "169ddfc35cb958a3", "scanner": "scanner-primary", "fingerprint": "c5de61c3cbb551dc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f886-m6hf-6m8v", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b968a49260920fdb", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "24a37fa2292eaf2e", "scanner": "scanner-primary", "fingerprint": "b968a49260920fdb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ffcf2ceae1166fd5", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "99d9dd5db915852f", "scanner": "scanner-primary", "fingerprint": "ffcf2ceae1166fd5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c2c1e7358a045bf2", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-v6h2-p8h4-qcjw"}, "properties": {"repobilityId": "23b502b342521550", "scanner": "scanner-primary", "fingerprint": "c2c1e7358a045bf2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v6h2-p8h4-qcjw", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64077296e8cf1cee", "level": "warning", "message": {"text": "Vulnerable dependency braces 3.0.2: GHSA-grv7-fg5c-xmjg"}, "properties": {"repobilityId": "73f750eedab5f355", "scanner": "scanner-primary", "fingerprint": "64077296e8cf1cee", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-grv7-fg5c-xmjg", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da02e6d118e4c7e3", "level": "note", "message": {"text": "Vulnerable dependency cookie 0.4.1: GHSA-pxg6-pf52-xh8x"}, "properties": {"repobilityId": "152ba7877b5fa631", "scanner": "scanner-primary", "fingerprint": "da02e6d118e4c7e3", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-pxg6-pf52-xh8x", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c6d563032fd590e7", "level": "error", "message": {"text": "Vulnerable dependency cross-spawn 7.0.3: GHSA-3xgq-45jj-v275"}, "properties": {"repobilityId": "ffc94a870a5dec07", "scanner": "scanner-primary", "fingerprint": "c6d563032fd590e7", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3xgq-45jj-v275", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18bbbe973b96ef7d", "level": "warning", "message": {"text": "Vulnerable dependency dottie 2.0.3: GHSA-4gxf-g5gf-22h4"}, "properties": {"repobilityId": "63f6c6183d994cc6", "scanner": "scanner-primary", "fingerprint": "18bbbe973b96ef7d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4gxf-g5gf-22h4", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-844a3dd8d4586195", "level": "warning", "message": {"text": "Vulnerable dependency engine.io 6.4.1: GHSA-q9mw-68c2-j6m5"}, "properties": {"repobilityId": "69d2acc7a496aedc", "scanner": "scanner-primary", "fingerprint": "844a3dd8d4586195", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q9mw-68c2-j6m5", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-23cf84200e979400", "level": "warning", "message": {"text": "Vulnerable dependency engine.io 6.4.1: GHSA-r635-g3xr-vw7x"}, "properties": {"repobilityId": "2b4f8b40e75c011a", "scanner": "scanner-primary", "fingerprint": "23cf84200e979400", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r635-g3xr-vw7x", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c61e2f4f6e0109d", "level": "error", "message": {"text": "Vulnerable dependency ws 8.11.0: GHSA-3h5v-q93c-6h6q"}, "properties": {"repobilityId": "aaa66ab7ff86f1db", "scanner": "scanner-primary", "fingerprint": "0c61e2f4f6e0109d", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3h5v-q93c-6h6q", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-38e2cf3c08889666", "level": "warning", "message": {"text": "Vulnerable dependency ws 8.11.0: GHSA-58qx-3vcg-4xpx"}, "properties": {"repobilityId": "5c73aef2d8d50a05", "scanner": "scanner-primary", "fingerprint": "38e2cf3c08889666", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-58qx-3vcg-4xpx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b85cfb277d0e20e", "level": "error", "message": {"text": "Vulnerable dependency ws 8.11.0: GHSA-96hv-2xvq-fx4p"}, "properties": {"repobilityId": "564cf56d9e90fac5", "scanner": "scanner-primary", "fingerprint": "6b85cfb277d0e20e", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-96hv-2xvq-fx4p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e16cffcf34511d5", "level": "warning", "message": {"text": "Vulnerable dependency semver 6.3.0: GHSA-c2qf-rxjj-qqgw"}, "properties": {"repobilityId": "bd64665701cbf5da", "scanner": "scanner-primary", "fingerprint": "4e16cffcf34511d5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-c2qf-rxjj-qqgw", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e10cd8d36e5277e6", "level": "error", "message": {"text": "Vulnerable dependency cross-spawn 6.0.5: GHSA-3xgq-45jj-v275"}, "properties": {"repobilityId": "4f614009f70739bf", "scanner": "scanner-primary", "fingerprint": "e10cd8d36e5277e6", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3xgq-45jj-v275", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81122442855d6f47", "level": "warning", "message": {"text": "Vulnerable dependency semver 5.7.1: GHSA-c2qf-rxjj-qqgw"}, "properties": {"repobilityId": "fa1e73955d8fffdd", "scanner": "scanner-primary", "fingerprint": "81122442855d6f47", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-c2qf-rxjj-qqgw", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-088e5349f8b3bb9d", "level": "error", "message": {"text": "Vulnerable dependency flatted 2.0.2: GHSA-25h7-pfq9-p65f"}, "properties": {"repobilityId": "584f2aeea2d8604d", "scanner": "scanner-primary", "fingerprint": "088e5349f8b3bb9d", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-25h7-pfq9-p65f", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0fd7ca315101ea74", "level": "warning", "message": {"text": "Vulnerable dependency flatted 2.0.2: GHSA-rf6f-7fwh-wjgh"}, "properties": {"repobilityId": "45b5253cde01c0c5", "scanner": "scanner-primary", "fingerprint": "0fd7ca315101ea74", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rf6f-7fwh-wjgh", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b1eb36fccbd6a82a", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 3.14.1: GHSA-2883-xcg3-v3hh"}, "properties": {"repobilityId": "4021da828c2daf3d", "scanner": "scanner-primary", "fingerprint": "b1eb36fccbd6a82a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2883-xcg3-v3hh", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fa2c4bc3eeb626ce", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 3.14.1: GHSA-52cp-r559-cp3m"}, "properties": {"repobilityId": "2c30c7f2691e2a6d", "scanner": "scanner-primary", "fingerprint": "fa2c4bc3eeb626ce", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-52cp-r559-cp3m", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c62a300af29da974", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 3.14.1: GHSA-5p4m-2wfm-xmqj"}, "properties": {"repobilityId": "8824921baa7aa5e7", "scanner": "scanner-primary", "fingerprint": "c62a300af29da974", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5p4m-2wfm-xmqj", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-960a1beee15fc5d7", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 3.14.1: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": "ed976a4168e3b88f", "scanner": "scanner-primary", "fingerprint": "960a1beee15fc5d7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h67p-54hq-rp68", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7a0e99bcfeb3fb7", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 3.14.1: GHSA-mh29-5h37-fv8m"}, "properties": {"repobilityId": "97b8c011ddf9854f", "scanner": "scanner-primary", "fingerprint": "d7a0e99bcfeb3fb7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh29-5h37-fv8m", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53cb9106d0fae9bc", "level": "note", "message": {"text": "Vulnerable dependency cookie 0.4.2: GHSA-pxg6-pf52-xh8x"}, "properties": {"repobilityId": "cc03adf579946d28", "scanner": "scanner-primary", "fingerprint": "53cb9106d0fae9bc", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-pxg6-pf52-xh8x", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5347ac2c383802a", "level": "note", "message": {"text": "Vulnerable dependency cookie 0.5.0: GHSA-pxg6-pf52-xh8x"}, "properties": {"repobilityId": "dc3ac565787d4382", "scanner": "scanner-primary", "fingerprint": "c5347ac2c383802a", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-pxg6-pf52-xh8x", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b756203a323096f3", "level": "warning", "message": {"text": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-8gc5-j5rx-235r"}, "properties": {"repobilityId": "2810e03fce9817f8", "scanner": "scanner-primary", "fingerprint": "b756203a323096f3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8gc5-j5rx-235r", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86635d8944d6005c", "level": "warning", "message": {"text": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-fj3w-jwp8-x2g3"}, "properties": {"repobilityId": "9c3c2aa18bf35768", "scanner": "scanner-primary", "fingerprint": "86635d8944d6005c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fj3w-jwp8-x2g3", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d8030b230096cb00", "level": "warning", "message": {"text": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-gh4j-gqv2-49f6"}, "properties": {"repobilityId": "17a0107657c0bb55", "scanner": "scanner-primary", "fingerprint": "d8030b230096cb00", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-gh4j-gqv2-49f6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-265b20bf5a0fdc07", "level": "warning", "message": {"text": "Vulnerable dependency fast-xml-parser 4.1.2: GHSA-jp2q-39xq-3w4g"}, "properties": {"repobilityId": "77049c611d235d4e", "scanner": "scanner-primary", "fingerprint": "265b20bf5a0fdc07", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jp2q-39xq-3w4g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e132e1f2564a0ce8", "level": "error", "message": {"text": "Vulnerable dependency flatted 3.2.7: GHSA-25h7-pfq9-p65f"}, "properties": {"repobilityId": "e288c12f6740768d", "scanner": "scanner-primary", "fingerprint": "e132e1f2564a0ce8", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-25h7-pfq9-p65f", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-556fbfe5d2899cc5", "level": "warning", "message": {"text": "Vulnerable dependency flatted 3.2.7: GHSA-rf6f-7fwh-wjgh"}, "properties": {"repobilityId": "cf81ad36b3482d35", "scanner": "scanner-primary", "fingerprint": "556fbfe5d2899cc5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rf6f-7fwh-wjgh", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4b0bb8e8e1828f8c", "level": "warning", "message": {"text": "Vulnerable dependency follow-redirects 1.15.2: GHSA-cxjh-pqwp-8mfp"}, "properties": {"repobilityId": "b3758dd3e16e84d6", "scanner": "scanner-primary", "fingerprint": "4b0bb8e8e1828f8c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-cxjh-pqwp-8mfp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ed06e2713e78d17", "level": "warning", "message": {"text": "Vulnerable dependency follow-redirects 1.15.2: GHSA-jchw-25xp-jwwc"}, "properties": {"repobilityId": "5a974f803962ff55", "scanner": "scanner-primary", "fingerprint": "7ed06e2713e78d17", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jchw-25xp-jwwc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9dc771cf51c6db2", "level": "warning", "message": {"text": "Vulnerable dependency follow-redirects 1.15.2: GHSA-r4q5-vmmm-2653"}, "properties": {"repobilityId": "ef19f55a1338f52c", "scanner": "scanner-primary", "fingerprint": "c9dc771cf51c6db2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r4q5-vmmm-2653", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d6454b9324cebbd2", "level": "note", "message": {"text": "Dependency bcrypt is a major version behind"}, "properties": {"repobilityId": "e65004f9bc8f5b10", "scanner": "scanner-primary", "fingerprint": "d6454b9324cebbd2", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2947101fc867a39c", "level": "note", "message": {"text": "Dependency canvas is a major version behind"}, "properties": {"repobilityId": "598c228fca7dd443", "scanner": "scanner-primary", "fingerprint": "2947101fc867a39c", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-655bd925d7a4dedf", "level": "warning", "message": {"text": "Dependency eta is two or more major versions behind"}, "properties": {"repobilityId": "155ed42cc6b9a9cd", "scanner": "scanner-primary", "fingerprint": "655bd925d7a4dedf", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3719d1be68e7982b", "level": "warning", "message": {"text": "Dependency express-rate-limit is two or more major versions behind"}, "properties": {"repobilityId": "1cc5f51179c95122", "scanner": "scanner-primary", "fingerprint": "3719d1be68e7982b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a736687f245203a6", "level": "note", "message": {"text": "Dependency express is a major version behind"}, "properties": {"repobilityId": "9d1a16c84a268997", "scanner": "scanner-primary", "fingerprint": "a736687f245203a6", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-760a6a76539cb85e", "level": "warning", "message": {"text": "Dependency googleapis is two or more major versions behind"}, "properties": {"repobilityId": "40a57814ffb77c2c", "scanner": "scanner-primary", "fingerprint": "760a6a76539cb85e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1a02963b7b3e3358", "level": "note", "message": {"text": "Dependency gradient-string is a major version behind"}, "properties": {"repobilityId": "172f66f7fc5d5d2d", "scanner": "scanner-primary", "fingerprint": "1a02963b7b3e3358", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-44e80cddd45627e9", "level": "warning", "message": {"text": "Dependency mongoose is two or more major versions behind"}, "properties": {"repobilityId": "9f614bf34a935728", "scanner": "scanner-primary", "fingerprint": "44e80cddd45627e9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c5b8cd62495e1b1", "level": "note", "message": {"text": "Dependency mqtt is a major version behind"}, "properties": {"repobilityId": "3b2d5a610ea4dee4", "scanner": "scanner-primary", "fingerprint": "2c5b8cd62495e1b1", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24d5291fa5bced4c", "level": "note", "message": {"text": "Dependency node-cron is a major version behind"}, "properties": {"repobilityId": "d233edbc7d02b497", "scanner": "scanner-primary", "fingerprint": "24d5291fa5bced4c", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b0d2ffebae41a8a", "level": "warning", "message": {"text": "Dependency nodemailer is two or more major versions behind"}, "properties": {"repobilityId": "48ec3b713b5554a7", "scanner": "scanner-primary", "fingerprint": "8b0d2ffebae41a8a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-35e3030a1338ca76", "level": "warning", "message": {"text": "Dependency ora is two or more major versions behind"}, "properties": {"repobilityId": "f995df5c41f2a6c3", "scanner": "scanner-primary", "fingerprint": "35e3030a1338ca76", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9cdabee93ef5c35b", "level": "note", "message": {"text": "Dependency sqlite3 is a major version behind"}, "properties": {"repobilityId": "b3da910ba19959ef", "scanner": "scanner-primary", "fingerprint": "9cdabee93ef5c35b", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-799af57a127bf271", "level": "warning", "message": {"text": "Dependency totp-generator is two or more major versions behind"}, "properties": {"repobilityId": "d032a2357b10fe9c", "scanner": "scanner-primary", "fingerprint": "799af57a127bf271", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-842b641b8d0d6ee4", "level": "note", "message": {"text": "13 backend endpoints not called by scanned frontend"}, "properties": {"repobilityId": "3c8e96670c5e1f9f", "scanner": "scanner-primary", "fingerprint": "842b641b8d0d6ee4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}