{ "history": [ { "added": 0, "commit": "7c5b9cd51a70862b598d6125e50aae8af885d963", "date": "2026-11-01", "dependencies": 7, "errors": [], "fixable": 0, "go_version": null, "in_binary": null, "new_vulnerabilities": 0, "osv_confirmed": 0, "osv_only": 66, "ref": "eslint-plugin-security-v4.2.1", "release_changed": false, "release_integrity": "no-assets", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": null, "upgraded": 0, "vulnerabilities": { "Critical": 0, "High": 0, "Low": 0, "Medium": 0, "Negligible": 0, "Unknown": 0 }, "workflow": { "High": 9, "Low": 1, "Medium": 0, "files": 3 } }, { "added": 807, "commit": "7c5b9cd51a70862b598d6125e50aae8af885d963", "date": "2026-11-02", "dependencies": 814, "errors": [], "fixable": 104, "go_version": null, "in_binary": null, "kev": 0, "kev_new": 0, "new_vulnerabilities": 77, "osv_confirmed": 66, "osv_only": 0, "ref": "eslint-plugin-security-v4.2.1", "release_changed": false, "release_integrity": "no-assets", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": null, "scorecard_date": null, "scorecard_note": "the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used", "scorecard_source": null, "upgraded": 0, "vulnerabilities": { "Critical": 6, "High": 50, "Low": 10, "Medium": 42, "Negligible": 0, "Unknown": 0 }, "vulnerable_packages": 48, "workflow": { "High": 9, "Low": 1, "Medium": 0, "files": 3 } } ], "latest": { "archived": false, "category": "Static Application Security Testing (SAST) \u203a Language-specific \u203a JavaScript/Node.js", "changes": { "added": [ "@aashutoshrathi/word-wrap@1.2.6", "@andrewbranch/untar.js@1.0.4", "@arethetypeswrong/cli@0.18.5", "@arethetypeswrong/core@0.18.5", "@babel/code-frame@7.16.7", "@babel/helper-validator-identifier@7.16.7", "@babel/highlight@7.17.9", "@braidai/lang@1.1.2", "@colors/colors@1.5.0", "@eslint-community/eslint-utils@4.4.0", "@eslint-community/regexpp@4.9.1", "@eslint/eslintrc@3.0.2", "@eslint/js@9.0.0", "@gar/promisify@1.1.3", "@humanwhocodes/config-array@0.12.3", "@humanwhocodes/module-importer@1.0.1", "@humanwhocodes/object-schema@2.0.3", "@isaacs/cliui@8.0.2", "@isaacs/string-locale-compare@1.1.0", "@jest/schemas@29.0.0", "@loaderkit/resolve@1.0.6", "@nodelib/fs.scandir@2.1.5", "@nodelib/fs.stat@2.0.5", "@nodelib/fs.walk@1.2.8", "@npmcli/arborist@5.6.3", "@npmcli/ci-detect@2.0.0", "@npmcli/config@4.2.2", "@npmcli/disparity-colors@2.0.0", "@npmcli/fs@2.1.2", "@npmcli/git@3.0.2", "@npmcli/installed-package-contents@1.0.7", "@npmcli/map-workspaces@2.0.4", "@npmcli/metavuln-calculator@3.1.1", "@npmcli/move-file@2.0.1", "@npmcli/name-from-folder@1.0.1", "@npmcli/node-gyp@2.0.0", "@npmcli/package-json@2.0.0", "@npmcli/promise-spawn@3.0.0", "@npmcli/query@1.2.0", "@npmcli/run-script@4.2.1", "@octokit/auth-token@2.5.0", "@octokit/core@3.6.0", "@octokit/endpoint@6.0.12", "@octokit/graphql@4.8.0", "@octokit/openapi-types@11.2.0", "@octokit/plugin-paginate-rest@2.17.0", "@octokit/plugin-request-log@1.0.4", "@octokit/plugin-rest-endpoint-methods@5.13.0", "@octokit/request@5.6.3", "@octokit/request-error@2.1.0", "@octokit/rest@18.12.0", "@octokit/types@6.34.0", "@pkgjs/parseargs@0.11.0", "@semantic-release/commit-analyzer@9.0.2", "@semantic-release/error@2.2.0", "@semantic-release/error@3.0.0", "@semantic-release/github@8.0.4", "@semantic-release/npm@9.0.1", "@semantic-release/release-notes-generator@10.0.3", "@sinclair/typebox@0.24.51", "@sindresorhus/is@4.6.0", "@tootallnate/once@2.0.0", "@types/eslint@9.6.1", "@types/estree@1.0.9", "@types/json-schema@7.0.15", "@types/minimist@1.2.2", "@types/normalize-package-data@2.4.1", "@types/parse-json@4.0.0", "@types/retry@0.12.1", "@types/semver@7.5.8", "@typescript-eslint/scope-manager@5.62.0", "@typescript-eslint/types@5.62.0", "@typescript-eslint/typescript-estree@5.62.0", "@typescript-eslint/utils@5.62.0", "@typescript-eslint/visitor-keys@5.62.0", "@typescript/typescript-aix-ppc64@7.0.2", "@typescript/typescript-darwin-arm64@7.0.2", "@typescript/typescript-darwin-x64@7.0.2", "@typescript/typescript-freebsd-arm64@7.0.2", "@typescript/typescript-freebsd-x64@7.0.2", "@typescript/typescript-linux-arm@7.0.2", "@typescript/typescript-linux-arm64@7.0.2", "@typescript/typescript-linux-loong64@7.0.2", "@typescript/typescript-linux-mips64el@7.0.2", "@typescript/typescript-linux-ppc64@7.0.2", "@typescript/typescript-linux-riscv64@7.0.2", "@typescript/typescript-linux-s390x@7.0.2", "@typescript/typescript-linux-x64@7.0.2", "@typescript/typescript-netbsd-arm64@7.0.2", "@typescript/typescript-netbsd-x64@7.0.2", "@typescript/typescript-openbsd-arm64@7.0.2", "@typescript/typescript-openbsd-x64@7.0.2", "@typescript/typescript-sunos-x64@7.0.2", "@typescript/typescript-win32-arm64@7.0.2", "@typescript/typescript-win32-x64@7.0.2", "abbrev@1.1.1", "acorn@8.11.3", "acorn-jsx@5.3.2", "agent-base@6.0.2", "agentkeepalive@4.2.1", "aggregate-error@3.1.0", "ajv@5.5.2", "ajv@6.12.6", "ajv@8.11.2", "ansi-escapes@4.3.2", "ansi-escapes@5.0.0", "ansi-escapes@7.3.0", "ansi-regex@5.0.1", "ansi-regex@6.2.2", "ansi-styles@3.2.1", "ansi-styles@4.3.0", "ansi-styles@5.2.0", "ansi-styles@6.1.0", "ansi-styles@6.2.3", "ansicolors@0.3.2", "any-promise@1.3.0", "aproba@2.0.0", "archy@1.0.0", "are-we-there-yet@3.0.1", "argparse@2.0.1", "argv-formatter@1.0.0", "array-ify@1.0.0", "array-union@2.1.0", "arrify@1.0.1", "asap@2.0.6", "asn1@0.2.6", "assert-plus@1.0.0", "astral-regex@2.0.0", "asynckit@0.4.0", "aws-sign2@0.7.0", "aws4@1.13.0", "balanced-match@1.0.0", "balanced-match@1.0.2", "bcrypt-pbkdf@1.0.2", "before-after-hook@2.2.2", "bin-links@3.0.3", "binary-extensions@2.2.0", "boolean@3.2.0", "boom@4.3.1", "boom@5.3.3", "bottleneck@2.19.5", "brace-expansion@1.1.11", "brace-expansion@1.1.18", "brace-expansion@2.0.1", "brace-expansion@2.1.4", "braces@3.0.3", "browser-stdout@1.3.1", "builtins@5.0.1", "cacache@16.1.3", "call-bind@1.0.2", "callsites@3.1.0", "camelcase@5.3.1", "camelcase@6.3.0", "camelcase-keys@6.2.2", "cardinal@2.1.1", "caseless@0.12.0", "chalk@2.3.0", "chalk@2.4.2", "chalk@4.1.2", "chalk@5.0.1", "chalk@5.6.2", "changelog@1.4.2", "char-regex@1.0.2", "chokidar@4.0.3", "chownr@2.0.0", "ci-info@1.6.0", "cidr-regex@3.1.1", "cjs-module-lexer@1.4.3", "clean-stack@2.2.0", "cli@1.0.1", "cli-columns@4.0.0", "cli-cursor@3.1.0", "cli-highlight@2.1.11", "cli-table3@0.6.2", "cli-table3@0.6.5", "cli-truncate@2.1.0", "cli-truncate@3.1.0", "cliui@7.0.4", "cliui@8.0.1", "clone@1.0.4", "cmd-shim@5.0.0", "co@4.6.0", "color-convert@1.9.3", "color-convert@2.0.1", "color-name@1.1.3", "color-name@1.1.4", "color-support@1.1.3", "colorette@2.0.16", "columnify@1.6.0", "combined-stream@1.0.8", "commander@10.0.1", "commander@8.3.0", "commander@9.4.1", "common-ancestor-path@1.0.1", "compare-func@2.0.0", "concat-map@0.0.1", "console-control-strings@1.1.0", "conventional-changelog-angular@5.0.13", "conventional-changelog-writer@5.0.1", "conventional-commits-filter@2.0.7", "conventional-commits-parser@3.2.4", "core-util-is@1.0.2", "cosmiconfig@7.0.1", "cosmiconfig@8.0.0", "cross-spawn@5.1.0", "cross-spawn@6.0.5", "cross-spawn@7.0.6", "cryptiles@3.2.1", "crypto-random-string@2.0.0", "cssesc@3.0.0", "dashdash@1.14.1", "dateformat@3.0.3", "debug@4.3.4", "debug@4.4.3", "debuglog@1.0.1", "decamelize@1.2.0", "decamelize@4.0.0", "decamelize-keys@1.1.0", "deep-extend@0.6.0", "deep-is@0.1.4", "deepmerge@4.2.2", "defaults@1.0.3", "define-properties@1.1.4", "del@6.0.0", "delayed-stream@1.0.0", "delegates@1.0.0", "depd@1.1.2", "deprecation@2.3.1", "dezalgo@1.0.4", "diff@5.1.0", "diff@7.0.0", "diff-sequences@29.3.1", "dir-glob@3.0.1", "dot-prop@5.3.0", "dot-prop@7.2.0", "duplexer2@0.1.4", "eastasianwidth@0.2.0", "ecc-jsbn@0.1.2", "emoji-regex@8.0.0", "emoji-regex@9.2.2", "emojilib@2.4.0", "encoding@0.1.13", "entities@3.0.1", "env-ci@5.5.0", "env-paths@2.2.1", "environment@1.1.0", "err-code@2.0.3", "error-ex@1.3.2", "es-abstract@1.20.5", "es-to-primitive@1.2.1", "escalade@3.1.1", "escape-string-regexp@1.0.5", "escape-string-regexp@4.0.0", "eslint@9.0.0", "eslint-config-prettier@8.5.0", "eslint-doc-generator@1.7.0", "eslint-plugin-eslint-plugin@5.5.1", "eslint-scope@5.1.1", "eslint-scope@8.0.1", "eslint-utils@3.0.0", "eslint-visitor-keys@2.1.0", "eslint-visitor-keys@3.4.3", "eslint-visitor-keys@4.0.0", "espree@10.0.1", "esprima@4.0.1", "esquery@1.5.0", "esrecurse@4.3.0", "estraverse@4.3.0", "estraverse@5.3.0", "esutils@2.0.3", "execa@0.8.0", "execa@5.1.1", "exit@0.1.2", "expect-type@1.4.0", "extend@3.0.2", "extsprintf@1.3.0", "fast-deep-equal@1.1.0", "fast-deep-equal@3.1.3", "fast-glob@3.2.11", "fast-json-stable-stringify@2.1.0", "fast-levenshtein@2.0.6", "fastest-levenshtein@1.0.12", "fastq@1.13.0", "fflate@0.8.3", "figures@2.0.0", "figures@3.2.0", "file-entry-cache@8.0.0", "fill-range@7.1.1", "find-up@2.1.0", "find-up@4.1.0", "find-up@5.0.0", "find-versions@4.0.0", "flat@5.0.2", "flat-cache@4.0.1", "flatted@3.4.2", "foreground-child@3.3.1", "forever-agent@0.6.1", "form-data@2.3.3", "from2@2.3.0", "fromentries@1.3.2", "fs-extra@10.1.0", "fs-minipass@2.1.0", "fs.realpath@1.0.0", "function-bind@1.1.1", "function.prototype.name@1.1.5", "functions-have-names@1.2.3", "gauge@4.0.4", "get-caller-file@2.0.5", "get-intrinsic@1.1.3", "get-stdin@9.0.0", "get-stream@3.0.0", "get-stream@6.0.1", "get-symbol-description@1.0.0", "getpass@0.1.7", "git-log-parser@1.2.0", "github-url-from-git@1.5.0", "glob@10.5.0", "glob@7.2.0", "glob@7.2.3", "glob@8.0.3", "glob-parent@5.1.2", "glob-parent@6.0.2", "globals@14.0.0", "globby@11.1.0", "gopd@1.0.1", "graceful-fs@4.2.10", "graphemer@1.4.0", "handlebars@4.7.9", "har-schema@2.0.0", "har-validator@5.0.3", "hard-rejection@2.1.0", "has@1.0.3", "has-bigints@1.0.2", "has-color@0.1.7", "has-flag@2.0.0", "has-flag@3.0.0", "has-flag@4.0.0", "has-property-descriptors@1.0.0", "has-symbols@1.0.3", "has-tostringtag@1.0.0", "has-unicode@2.0.1", "hawk@6.0.2", "he@1.2.0", "highlight.js@10.7.3", "hoek@4.3.1", "hook-std@2.0.0", "hosted-git-info@2.8.9", "hosted-git-info@4.1.0", "hosted-git-info@5.2.1", "http-cache-semantics@4.1.1", "http-proxy-agent@5.0.0", "http-signature@1.2.0", "https-proxy-agent@5.0.1", "human-signals@2.1.0", "humanize-ms@1.2.1", "iconv-lite@0.6.3", "ignore@5.2.0", "ignore-walk@5.0.1", "import-fresh@3.3.0", "import-from@4.0.0", "imurmurhash@0.1.4", "indent-string@4.0.0", "infer-owner@1.0.4", "inflight@1.0.6", "inherits@2.0.3", "inherits@2.0.4", "ini@1.3.8", "ini@3.0.1", "init-package-json@3.0.2", "internal-slot@1.0.3", "into-stream@6.0.0", "ip@2.0.0", "ip-regex@4.3.0", "is-arrayish@0.2.1", "is-bigint@1.0.4", "is-boolean-object@1.1.2", "is-callable@1.2.7", "is-ci@1.2.1", "is-cidr@4.0.2", "is-core-module@2.10.0", "is-core-module@2.8.1", "is-date-object@1.0.5", "is-extglob@2.1.1", "is-fullwidth-code-point@3.0.0", "is-fullwidth-code-point@4.0.0", "is-glob@4.0.3", "is-lambda@1.0.1", "is-negative-zero@2.0.2", "is-number@7.0.0", "is-number-object@1.0.7", "is-obj@2.0.0", "is-path-cwd@2.2.0", "is-path-inside@3.0.3", "is-plain-obj@1.1.0", "is-plain-obj@2.1.0", "is-plain-object@5.0.0", "is-regex@1.1.4", "is-shared-array-buffer@1.0.2", "is-stream@1.1.0", "is-stream@2.0.1", "is-string@1.0.7", "is-symbol@1.0.4", "is-text-path@1.0.1", "is-typedarray@1.0.0", "is-unicode-supported@0.1.0", "is-weakref@1.0.2", "isarray@1.0.0", "isexe@2.0.0", "isstream@0.1.2", "issue-parser@6.0.0", "jackspeak@3.4.3", "java-properties@1.0.2", "jest-diff@29.3.1", "jest-get-type@29.2.0", "js-tokens@4.0.0", "js-yaml@4.3.2", "jsbn@0.1.1", "json-buffer@3.0.1", "json-parse-better-errors@1.0.2", "json-parse-even-better-errors@2.3.1", "json-schema@0.4.0", "json-schema-traverse@0.3.1", "json-schema-traverse@0.4.1", "json-schema-traverse@1.0.0", "json-stable-stringify-without-jsonify@1.0.1", "json-stringify-nice@1.1.4", "json-stringify-safe@5.0.1", "jsonc-parser@3.1.0", "jsonfile@6.1.0", "jsonparse@1.3.1", "JSONStream@1.3.5", "jsprim@1.4.2", "just-diff@5.1.1", "just-diff-apply@5.4.1", "keyv@4.5.4", "kind-of@6.0.3", "levn@0.4.1", "libnpmaccess@6.0.4", "libnpmdiff@4.0.5", "libnpmexec@4.0.14", "libnpmfund@3.0.5", "libnpmhook@8.0.4", "libnpmorg@4.0.4", "libnpmpack@4.1.3", "libnpmpublish@6.0.5", "libnpmsearch@5.0.4", "libnpmteam@4.0.4", "libnpmversion@3.0.7", "lilconfig@2.0.4", "lines-and-columns@1.2.4", "linkify-it@4.0.1", "lint-staged@12.3.7", "listr2@4.0.5", "load-json-file@4.0.0", "locate-path@2.0.0", "locate-path@5.0.0", "locate-path@6.0.0", "lodash@4.17.21", "lodash@4.17.5", "lodash.capitalize@4.2.1", "lodash.escaperegexp@4.1.2", "lodash.ismatch@4.4.0", "lodash.isplainobject@4.0.6", "lodash.isstring@4.0.1", "lodash.merge@4.6.2", "lodash.uniqby@4.7.0", "log-symbols@4.1.0", "log-update@4.0.0", "lower-case@2.0.2", "lru-cache@10.4.3", "lru-cache@11.5.2", "lru-cache@4.1.5", "lru-cache@6.0.0", "lru-cache@7.13.2", "make-fetch-happen@10.2.1", "map-obj@1.0.1", "map-obj@4.3.0", "markdown-it@13.0.1", "markdown-table@3.0.3", "markdownlint@0.26.2", "markdownlint-cli@0.32.2", "markdownlint-rule-helpers@0.17.2", "marked@4.0.14", "marked@9.1.6", "marked-terminal@5.1.1", "marked-terminal@7.3.0", "mdurl@1.0.1", "memorystream@0.3.1", "meow@8.1.2", "merge-stream@2.0.0", "merge2@1.4.1", "micromatch@4.0.5", "mime@3.0.0", "mime-db@1.52.0", "mime-types@2.1.35", "mimic-fn@2.1.0", "min-indent@1.0.1", "minimatch@3.1.2", "minimatch@3.1.5", "minimatch@5.1.0", "minimatch@5.1.9", "minimatch@9.0.9", "minimist@1.2.6", "minimist-options@4.1.0", "minipass@3.3.4", "minipass@7.1.2", "minipass-collect@1.0.2", "minipass-fetch@2.1.1", "minipass-flush@1.0.5", "minipass-json-stream@1.0.1", "minipass-pipeline@1.2.4", "minipass-sized@1.0.3", "minizlib@2.1.2", "mkdirp@1.0.4", "mkdirp-infer-owner@2.0.0", "mocha@11.7.5", "modify-values@1.0.1", "moment@2.20.1", "ms@2.1.2", "ms@2.1.3", "mute-stream@0.0.8", "mz@2.7.0", "natural-compare@1.4.0", "negotiator@0.6.3", "neo-async@2.6.2", "nerf-dart@1.0.0", "nice-try@1.0.5", "no-case@3.0.4", "node-emoji@1.11.0", "node-emoji@2.2.0", "node-fetch@2.6.7", "node-gyp@9.1.0", "nopt@5.0.0", "nopt@6.0.0", "normalize-package-data@2.5.0", "normalize-package-data@3.0.3", "normalize-package-data@4.0.1", "normalize-path@1.0.0", "normalize-path@3.0.0", "normalize-url@6.1.0", "npm@8.19.4", "npm-audit-report@3.0.0", "npm-bundled@1.1.2", "npm-bundled@2.0.1", "npm-install-checks@5.0.0", "npm-normalize-package-bin@1.0.1", "npm-normalize-package-bin@2.0.0", "npm-package-arg@9.1.0", "npm-packlist@5.1.3", "npm-pick-manifest@7.0.2", "npm-profile@6.2.1", "npm-registry-fetch@13.3.1", "npm-run-all@4.1.5", "npm-run-path@2.0.2", "npm-run-path@4.0.1", "npm-user-validate@1.0.1", "npmlog@6.0.2", "oauth-sign@0.8.2", "object-assign@4.1.1", "object-inspect@1.12.2", "object-keys@1.1.1", "object.assign@4.1.4", "once@1.4.0", "onetime@5.1.2", "opener@1.5.2", "optionator@0.9.3", "p-each-series@2.2.0", "p-filter@2.1.0", "p-finally@1.0.0", "p-is-promise@3.0.0", "p-limit@1.3.0", "p-limit@2.3.0", "p-limit@3.1.0", "p-locate@2.0.0", "p-locate@4.1.0", "p-locate@5.0.0", "p-map@2.1.0", "p-map@4.0.0", "p-reduce@2.1.0", "p-retry@4.6.1", "p-try@1.0.0", "p-try@2.2.0", "package-json-from-dist@1.0.1", "pacote@13.6.2", "parent-module@1.0.1", "parse-conflict-json@2.0.2", "parse-json@4.0.0", "parse-json@5.2.0", "parse5@5.1.1", "parse5@6.0.1", "parse5-htmlparser2-tree-adapter@6.0.1", "path-exists@3.0.0", "path-exists@4.0.0", "path-is-absolute@1.0.1", "path-key@2.0.1", "path-key@3.1.1", "path-parse@1.0.7", "path-scurry@1.11.1", "path-type@3.0.0", "path-type@4.0.0", "performance-now@2.1.0", "picocolors@1.1.1", "picomatch@2.3.2", "pidtree@0.3.1", "pidtree@0.5.0", "pify@3.0.0", "pkg-conf@2.1.0", "postcss-selector-parser@6.0.10", "prelude-ls@1.2.1", "prettier@3.9.9", "pretty-format@29.3.1", "proc-log@2.0.1", "process-nextick-args@2.0.1", "promise-all-reject-late@1.0.1", "promise-call-limit@1.0.1", "promise-inflight@1.0.1", "promise-retry@2.0.1", "promzard@0.3.0", "pseudomap@1.0.2", "punycode@1.4.1", "punycode@2.1.1", "q@1.5.1", "qrcode-terminal@0.12.0", "qs@6.5.3", "queue-microtask@1.2.3", "quick-lru@4.0.1", "randombytes@2.1.0", "rc@1.2.8", "react-is@18.2.0", "read@1.0.7", "read-cmd-shim@3.0.0", "read-package-json@5.0.2", "read-package-json-fast@2.0.3", "read-pkg@3.0.0", "read-pkg@5.2.0", "read-pkg-up@7.0.1", "readable-stream@2.3.7", "readable-stream@3.6.0", "readdir-scoped-modules@1.1.0", "readdirp@4.1.2", "redent@3.0.0", "redeyed@2.1.1", "regexp.prototype.flags@1.4.3", "registry-auth-token@4.2.1", "request@2.83.0", "require-directory@2.1.1", "require-from-string@2.0.2", "resolve@1.22.0", "resolve-from@4.0.0", "resolve-from@5.0.0", "restore-cursor@3.1.0", "retry@0.12.0", "retry@0.13.1", "reusify@1.0.4", "rfdc@1.3.0", "rimraf@3.0.2", "run-con@1.2.11", "run-parallel@1.2.0", "rxjs@7.5.5", "safe-buffer@5.1.2", "safe-buffer@5.2.1", "safe-regex-test@1.0.0", "safer-buffer@2.1.2", "semantic-release@19.0.3", "semver@5.5.0", "semver@5.7.1", "semver@6.3.0", "semver@7.3.7", "semver@7.6.0", "semver@7.8.5", "semver-diff@3.1.1", "semver-regex@3.1.3", "serialize-javascript@6.0.2", "set-blocking@2.0.0", "shebang-command@1.2.0", "shebang-command@2.0.0", "shebang-regex@1.0.0", "shebang-regex@3.0.0", "shell-quote@1.10.0", "side-channel@1.0.4", "signal-exit@3.0.7", "signal-exit@4.1.0", "signale@1.4.0", "skin-tone@2.0.0", "slash@3.0.0", "slice-ansi@3.0.0", "slice-ansi@4.0.0", "slice-ansi@5.0.0", "smart-buffer@4.2.0", "sntp@2.1.0", "socks@2.7.0", "socks-proxy-agent@7.0.0", "source-map@0.6.1", "spawn-error-forwarder@1.0.0", "spdx-correct@3.1.1", "spdx-exceptions@2.3.0", "spdx-expression-parse@3.0.1", "spdx-license-ids@3.0.11", "split@1.0.1", "split2@1.0.0", "split2@3.2.2", "sshpk@1.18.0", "ssri@9.0.1", "stream-combiner2@1.1.1", "string-argv@0.3.1", "string-width@4.2.3", "string-width@5.1.2", "string.prototype.padend@3.1.4", "string.prototype.trimend@1.0.6", "string.prototype.trimstart@1.0.6", "string_decoder@1.1.1", "string_decoder@1.3.0", "stringstream@0.0.6", "strip-ansi@6.0.1", "strip-ansi@7.1.2", "strip-bom@3.0.0", "strip-eof@1.0.0", "strip-final-newline@2.0.0", "strip-indent@2.0.0", "strip-indent@3.0.0", "strip-json-comments@2.0.1", "strip-json-comments@3.1.1", "supports-color@4.5.0", "supports-color@5.5.0", "supports-color@7.2.0", "supports-color@8.1.1", "supports-color@9.2.1", "supports-hyperlinks@2.2.0", "supports-hyperlinks@3.2.0", "supports-preserve-symlinks-flag@1.0.0", "tar@6.1.11", "temp-dir@2.0.0", "tempy@1.0.1", "text-extensions@1.9.0", "text-table@0.2.0", "thenify@3.3.1", "thenify-all@1.6.0", "through@2.3.8", "through2@2.0.5", "through2@4.0.2", "tiny-relative-date@1.3.0", "to-regex-range@5.0.1", "tough-cookie@2.3.4", "tr46@0.0.3", "traverse@0.6.6", "treeverse@2.0.0", "trim-newlines@3.0.1", "tslib@1.14.1", "tslib@2.3.1", "tsutils@3.21.0", "tunnel-agent@0.6.0", "tweetnacl@0.14.5", "type-check@0.4.0", "type-fest@0.16.0", "type-fest@0.18.1", "type-fest@0.21.3", "type-fest@0.6.0", "type-fest@0.8.1", "type-fest@1.4.0", "type-fest@2.19.0", "type-fest@3.3.0", "typescript@5.6.1-rc", "typescript@7.0.2", "uc.micro@1.0.6", "uglify-js@3.15.4", "unbox-primitive@1.0.2", "unicode-emoji-modifier-base@1.0.0", "unique-filename@2.0.1", "unique-slug@3.0.0", "unique-string@2.0.0", "universal-user-agent@6.0.0", "universalify@2.0.0", "uri-js@4.4.1", "url-join@4.0.1", "util-deprecate@1.0.2", "uuid@3.4.0", "validate-npm-package-license@3.0.4", "validate-npm-package-name@4.0.0", "validate-npm-package-name@5.0.1", "verror@1.10.0", "walk-up-path@1.0.0", "wcwidth@1.0.1", "webidl-conversions@3.0.1", "whatwg-url@5.0.0", "which@1.3.1", "which@2.0.2", "which-boxed-primitive@1.0.2", "wide-align@1.1.5", "wordwrap@1.0.0", "workerpool@9.3.4", "wrap-ansi@6.2.0", "wrap-ansi@7.0.0", "wrap-ansi@8.1.0", "wrappy@1.0.2", "write-file-atomic@4.0.2", "xtend@4.0.1", "y18n@5.0.8", "yallist@2.1.2", "yallist@4.0.0", "yaml@1.10.2", "yargs@16.2.0", "yargs@17.7.2", "yargs-parser@20.2.4", "yargs-parser@21.1.1", "yargs-unparser@2.0.0", "yocto-queue@0.1.0", "yorkie@2.0.0" ], "any": true, "baseline": false, "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [ { "aliases": [ "CVE-2026-48801" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-48801", "percentile": 0.3357, "score": 0.00394 }, "fix_state": "fixed", "fixed_in": [ "5.0.1" ], "id": "GHSA-22p9-wv53-3rq4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "linkify-it", "severity": "High", "summary": "LinkifyIt#match scan loop has quadratic algorithmic complexity", "url": "https://github.com/advisories/GHSA-22p9-wv53-3rq4", "version": "4.0.1" }, { "aliases": [ "CVE-2026-27904" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27904", "percentile": 0.44525, "score": 0.00525 }, "fix_state": "fixed", "fixed_in": [ "5.1.8" ], "id": "GHSA-23c5-xmqv-rm74", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "minimatch", "severity": "High", "summary": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions", "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74", "version": "5.1.0" }, { "aliases": [ "CVE-2026-59873" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59873", "percentile": 0.47807, "score": 0.00582 }, "fix_state": "fixed", "fixed_in": [ "7.5.19" ], "id": "GHSA-23hp-3jrh-7fpw", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "tar", "severity": "Critical", "summary": "node-tar: Decompression/parse DoS via unlimited input", "url": "https://github.com/advisories/GHSA-23hp-3jrh-7fpw", "version": "6.1.11" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "14.3.1" ], "id": "GHSA-253c-mchw-3w2r", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Medium", "summary": "markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds", "url": "https://github.com/advisories/GHSA-253c-mchw-3w2r", "version": "13.0.1" }, { "aliases": [ "CVE-2020-28500" ], "ecosystem": "npm", "epss": { "cve": "CVE-2020-28500", "percentile": 0.94394, "score": 0.07336 }, "fix_state": "fixed", "fixed_in": [ "4.17.21" ], "id": "GHSA-29mw-wpgm-hmr9", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "lodash", "severity": "Medium", "summary": "Regular Expression Denial of Service (ReDoS) in lodash", "url": "https://github.com/advisories/GHSA-29mw-wpgm-hmr9", "version": "4.17.5" }, { "aliases": [ "CVE-2025-69873" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-69873", "percentile": 0.45842, "score": 0.00547 }, "fix_state": "fixed", "fixed_in": [ "8.18.0" ], "id": "GHSA-2g4f-4pwh-qvx6", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ajv", "severity": "Medium", "summary": "ajv has ReDoS when using `$data` option", "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6", "version": "8.11.2" }, { "aliases": [ "CVE-2024-29415" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-29415", "percentile": 0.94917, "score": 0.08279 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-2p57-rm9w-gvfp", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "ip", "severity": "High", "summary": "ip SSRF improper categorization in isPublic", "url": "https://github.com/advisories/GHSA-2p57-rm9w-gvfp", "version": "2.0.0" }, { "aliases": [ "CVE-2026-24842" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-24842", "percentile": 0.49102, "score": 0.00608 }, "fix_state": "fixed", "fixed_in": [ "7.5.7" ], "id": "GHSA-34x7-hfp2-rc4v", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "tar", "severity": "High", "summary": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal", "url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v", "version": "6.1.11" }, { "aliases": [ "CVE-2021-23337" ], "ecosystem": "npm", "epss": { "cve": "CVE-2021-23337", "percentile": 0.97602, "score": 0.21333 }, "fix_state": "fixed", "fixed_in": [ "4.17.21" ], "id": "GHSA-35jh-r3h4-6jhm", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "lodash", "severity": "High", "summary": "Command Injection in lodash", "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm", "version": "4.17.5" }, { "aliases": [ "CVE-2026-2327" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-2327", "percentile": 0.54574, "score": 0.00739 }, "fix_state": "fixed", "fixed_in": [ "14.1.1" ], "id": "GHSA-38c4-r59v-3vqw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Medium", "summary": "markdown-it is has a Regular Expression Denial of Service (ReDoS)", "url": "https://github.com/advisories/GHSA-38c4-r59v-3vqw", "version": "13.0.1" }, { "aliases": [ "CVE-2026-118773" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118773", "percentile": 0.28707, "score": 0.0035 }, "fix_state": "fixed", "fixed_in": [ "14.0.2" ], "id": "GHSA-3g3m-2fjr-6pw4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "glob", "severity": "Medium", "summary": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal", "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4", "version": "10.5.0" }, { "aliases": [ "CVE-2026-13149" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-13149", "percentile": 0.3024, "score": 0.00364 }, "fix_state": "fixed", "fixed_in": [ "2.1.2" ], "id": "GHSA-3jxr-9vmj-r5cp", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups", "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp", "version": "2.0.1" }, { "aliases": [ "CVE-2026-26996" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-26996", "percentile": 0.47571, "score": 0.00577 }, "fix_state": "fixed", "fixed_in": [ "5.1.7" ], "id": "GHSA-3ppc-4f35-3m26", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "minimatch", "severity": "High", "summary": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern", "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26", "version": "5.1.0" }, { "aliases": [ "CVE-2024-21538" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-21538", "percentile": 0.58749, "score": 0.00868 }, "fix_state": "fixed", "fixed_in": [ "6.0.6" ], "id": "GHSA-3xgq-45jj-v275", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "cross-spawn", "severity": "High", "summary": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "version": "6.0.5" }, { "aliases": [ "CVE-2022-29167" ], "ecosystem": "npm", "epss": { "cve": "CVE-2022-29167", "percentile": 0.65703, "score": 0.01101 }, "fix_state": "fixed", "fixed_in": [ "9.0.1" ], "id": "GHSA-44pw-h2cw-w3vq", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "hawk", "severity": "High", "summary": "Uncontrolled Resource Consumption in Hawk", "url": "https://github.com/advisories/GHSA-44pw-h2cw-w3vq", "version": "6.0.2" }, { "aliases": [ "CVE-2026-33532" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33532", "percentile": 0.42049, "score": 0.00488 }, "fix_state": "fixed", "fixed_in": [ "1.10.3" ], "id": "GHSA-48c2-rrv3-qjmp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "yaml", "severity": "Medium", "summary": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections", "url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp", "version": "1.10.2" }, { "aliases": [ "CVE-2026-82417" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-82417", "percentile": 0.33809, "score": 0.00396 }, "fix_state": "fixed", "fixed_in": [ "6.16.0" ], "id": "GHSA-4mjr-xmp4-gh2g", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs: Denial of Service via Attacker Controlled isBuffer", "url": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g", "version": "6.5.3" }, { "aliases": [ "CVE-2021-43307" ], "ecosystem": "npm", "epss": { "cve": "CVE-2021-43307", "percentile": 0.75201, "score": 0.01558 }, "fix_state": "fixed", "fixed_in": [ "3.1.4" ], "id": "GHSA-4x5v-gmq8-25ch", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "semver-regex", "severity": "Low", "summary": "Regular expression denial of service in semver-regex", "url": "https://github.com/advisories/GHSA-4x5v-gmq8-25ch", "version": "3.1.3" }, { "aliases": [ "CVE-2018-16487" ], "ecosystem": "npm", "epss": { "cve": "CVE-2018-16487", "percentile": 0.74126, "score": 0.01491 }, "fix_state": "fixed", "fixed_in": [ "4.17.11" ], "id": "GHSA-4xc9-xhrj-v574", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "lodash", "severity": "High", "summary": "Prototype Pollution in lodash", "url": "https://github.com/advisories/GHSA-4xc9-xhrj-v574", "version": "4.17.5" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "7.0.3" ], "id": "GHSA-5c6j-r48x-rmvq", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "serialize-javascript", "severity": "High", "summary": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()", "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq", "version": "6.0.2" }, { "aliases": [ "CVE-2026-102276" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102276", "percentile": 0.39514, "score": 0.00455 }, "fix_state": "fixed", "fixed_in": [ "2.1.5" ], "id": "GHSA-6j4f-fj2g-mc7p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion", "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p", "version": "2.1.4" }, { "aliases": [ "CVE-2025-15284" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-15284", "percentile": 0.39084, "score": 0.0045 }, "fix_state": "fixed", "fixed_in": [ "6.14.1" ], "id": "GHSA-6rw7-vpxm-498p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion", "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p", "version": "6.5.3" }, { "aliases": [ "CVE-2026-48988" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-48988", "percentile": 0.3186, "score": 0.00379 }, "fix_state": "fixed", "fixed_in": [ "14.2.0" ], "id": "GHSA-6v5v-wf23-fmfq", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Medium", "summary": "markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations", "url": "https://github.com/advisories/GHSA-6v5v-wf23-fmfq", "version": "13.0.1" }, { "aliases": [ "CVE-2023-26136" ], "ecosystem": "npm", "epss": { "cve": "CVE-2023-26136", "percentile": 0.85496, "score": 0.02627 }, "fix_state": "fixed", "fixed_in": [ "4.1.3" ], "id": "GHSA-72xf-g2v4-qvf3", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "tough-cookie", "severity": "Medium", "summary": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "version": "2.3.4" }, { "aliases": [ "CVE-2026-24001" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-24001", "percentile": 0.49541, "score": 0.00616 }, "fix_state": "fixed", "fixed_in": [ "8.0.3" ], "id": "GHSA-73rr-hh4g-fpgx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "diff", "severity": "Low", "summary": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch", "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx", "version": "7.0.0" }, { "aliases": [ "CVE-2023-42282" ], "ecosystem": "npm", "epss": { "cve": "CVE-2023-42282", "percentile": 0.75978, "score": 0.01613 }, "fix_state": "fixed", "fixed_in": [ "2.0.1" ], "id": "GHSA-78xj-cgh5-2h22", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "ip", "severity": "Low", "summary": "NPM IP package incorrectly identifies some private IP addresses as public", "url": "https://github.com/advisories/GHSA-78xj-cgh5-2h22", "version": "2.0.0" }, { "aliases": [ "CVE-2026-27903" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-27903", "percentile": 0.4749, "score": 0.00576 }, "fix_state": "fixed", "fixed_in": [ "5.1.8" ], "id": "GHSA-7r86-cg39-jmmj", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "minimatch", "severity": "High", "summary": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments", "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj", "version": "5.1.0" }, { "aliases": [ "CVE-2026-26960" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-26960", "percentile": 0.2599, "score": 0.00328 }, "fix_state": "fixed", "fixed_in": [ "7.5.8" ], "id": "GHSA-83g3-92jg-28cx", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "tar", "severity": "High", "summary": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction", "url": "https://github.com/advisories/GHSA-83g3-92jg-28cx", "version": "6.1.11" }, { "aliases": [ "CVE-2022-24785" ], "ecosystem": "npm", "epss": { "cve": "CVE-2022-24785", "percentile": 0.96524, "score": 0.1384 }, "fix_state": "fixed", "fixed_in": [ "2.29.2" ], "id": "GHSA-8hfj-j24r-96c4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "moment", "severity": "High", "summary": "Path Traversal: 'dir/../../filename' in moment.locale", "url": "https://github.com/advisories/GHSA-8hfj-j24r-96c4", "version": "2.20.1" }, { "aliases": [ "CVE-2026-23745" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-23745", "percentile": 0.31588, "score": 0.00376 }, "fix_state": "fixed", "fixed_in": [ "7.5.3" ], "id": "GHSA-8qq5-rm4j-mr97", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "tar", "severity": "High", "summary": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization", "url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97", "version": "6.1.11" }, { "aliases": [ "CVE-2026-106446" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-106446", "percentile": 0.56143, "score": 0.00786 }, "fix_state": "fixed", "fixed_in": [ "4.7.10" ], "id": "GHSA-8r5x-fm3f-whwj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "handlebars", "severity": "Critical", "summary": "Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)", "url": "https://github.com/advisories/GHSA-8r5x-fm3f-whwj", "version": "4.7.9" }, { "aliases": [ "CVE-2026-59874" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59874", "percentile": 0.37686, "score": 0.00434 }, "fix_state": "fixed", "fixed_in": [ "7.5.18" ], "id": "GHSA-8x88-c5mf-7j5w", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "tar", "severity": "High", "summary": "node-tar: Negative tar entry size causes infinite loop in archive replace", "url": "https://github.com/advisories/GHSA-8x88-c5mf-7j5w", "version": "6.1.11" }, { "aliases": [ "CVE-2024-4067" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-4067", "percentile": 0.73001, "score": 0.01429 }, "fix_state": "fixed", "fixed_in": [ "4.0.8" ], "id": "GHSA-952p-6rrq-rcjv", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "micromatch", "severity": "Medium", "summary": "Regular Expression Denial of Service (ReDoS) in micromatch", "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv", "version": "4.0.5" }, { "aliases": [ "CVE-2026-31802" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-31802", "percentile": 0.19054, "score": 0.00269 }, "fix_state": "fixed", "fixed_in": [ "7.5.11" ], "id": "GHSA-9ppj-qmqm-q256", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "tar", "severity": "High", "summary": "node-tar Symlink Path Traversal via Drive-Relative Linkpath", "url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256", "version": "6.1.11" }, { "aliases": [ "CVE-2022-25883" ], "ecosystem": "npm", "epss": { "cve": "CVE-2022-25883", "percentile": 0.86273, "score": 0.02761 }, "fix_state": "fixed", "fixed_in": [ "7.5.2" ], "id": "GHSA-c2qf-rxjj-qqgw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "semver", "severity": "High", "summary": "semver vulnerable to Regular Expression Denial of Service", "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw", "version": "7.3.7" }, { "aliases": [ "CVE-2020-36604" ], "ecosystem": "npm", "epss": { "cve": "CVE-2020-36604", "percentile": 0.69193, "score": 0.01241 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-c429-5p7v-vgjp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "hoek", "severity": "High", "summary": "hoek subject to prototype pollution via the clone function.", "url": "https://github.com/advisories/GHSA-c429-5p7v-vgjp", "version": "4.3.1" }, { "aliases": [ "CVE-2026-2950" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-2950", "percentile": 0.2717, "score": 0.00337 }, "fix_state": "fixed", "fixed_in": [ "4.18.0" ], "id": "GHSA-f23m-r3pf-42rh", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "lodash", "severity": "Medium", "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`", "url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh", "version": "4.17.5" }, { "aliases": [ "CVE-2024-28863" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-28863", "percentile": 0.60592, "score": 0.00929 }, "fix_state": "fixed", "fixed_in": [ "6.2.1" ], "id": "GHSA-f5x3-32g6-xq36", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "tar", "severity": "Medium", "summary": "Denial of service while parsing a tar file due to lack of folders count validation", "url": "https://github.com/advisories/GHSA-f5x3-32g6-xq36", "version": "6.1.11" }, { "aliases": [ "CVE-2026-33750" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33750", "percentile": 0.38904, "score": 0.00447 }, "fix_state": "fixed", "fixed_in": [ "2.0.3" ], "id": "GHSA-f886-m6hf-6m8v", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "brace-expansion", "severity": "Medium", "summary": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "version": "2.0.1" }, { "aliases": [ "CVE-2025-7783" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-7783", "percentile": 0.78615, "score": 0.0181 }, "fix_state": "fixed", "fixed_in": [ "2.5.4" ], "id": "GHSA-fjxv-7rqg-78g4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "form-data", "severity": "Critical", "summary": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "version": "2.3.3" }, { "aliases": [ "CVE-2026-118764" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118764", "percentile": 0.21751, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "11.0.1" ], "id": "GHSA-g3hv-75wg-m249", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "Medium", "summary": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "version": "9.0.9" }, { "aliases": [ "CVE-2026-93753" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-93753", "percentile": 0.43819, "score": 0.00514 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-gcqx-w48m-w2h4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "deepmerge", "severity": "Low", "summary": "deepmerge mergeObject() allows prototype poisoning of returned objects", "url": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4", "version": "4.2.2" }, { "aliases": [ "CVE-2026-59875" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59875", "percentile": 0.29158, "score": 0.00354 }, "fix_state": "fixed", "fixed_in": [ "7.5.17" ], "id": "GHSA-gvwx-54wh-qm9j", "kev": null, "location": "package-lock.json", "osv_confirmed": false, "package": "tar", "severity": "Medium", "summary": "node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records", "url": "https://github.com/advisories/GHSA-gvwx-54wh-qm9j", "version": "6.1.11" }, { "aliases": [ "CVE-2025-25288" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-25288", "percentile": 0.50086, "score": 0.00628 }, "fix_state": "fixed", "fixed_in": [ "9.2.2" ], "id": "GHSA-h5c3-5r3r-rr8q", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@octokit/plugin-paginate-rest", "severity": "Medium", "summary": "@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking", "url": "https://github.com/advisories/GHSA-h5c3-5r3r-rr8q", "version": "2.17.0" }, { "aliases": [ "CVE-2026-12143" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-12143", "percentile": 0.51965, "score": 0.00669 }, "fix_state": "fixed", "fixed_in": [ "2.5.6" ], "id": "GHSA-hmw2-7cc7-3qxx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "form-data", "severity": "High", "summary": "form-data: CRLF injection in form-data via unescaped multipart field names and filenames", "url": "https://github.com/advisories/GHSA-hmw2-7cc7-3qxx", "version": "2.3.3" }, { "aliases": [ "CVE-2019-10744" ], "ecosystem": "npm", "epss": { "cve": "CVE-2019-10744", "percentile": 0.9224, "score": 0.05006 }, "fix_state": "fixed", "fixed_in": [ "4.17.12" ], "id": "GHSA-jf85-cpcp-j695", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "lodash", "severity": "Critical", "summary": "Prototype Pollution in lodash", "url": "https://github.com/advisories/GHSA-jf85-cpcp-j695", "version": "4.17.5" }, { "aliases": [ "CVE-2026-115897" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-115897", "percentile": 0.23496, "score": 0.00307 }, "fix_state": "fixed", "fixed_in": [ "7.1.3" ], "id": "GHSA-m5mm-p8h7-m29v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "serialize-javascript", "severity": "Low", "summary": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped