[VANTA] [VULNERABILITY] <CRITICAL> CVE-2024-21538, CVE-2024-37890, CVE-2024-4068 and others, fix before 2026-10-03

> [!IMPORTANT]
> CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.
>
> DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

`npm-next >= 15.3.0-canary.0, < 15.3.6` CODE_REPOSITORY/examples <ins>GHSA-9qr9-h5gf-34mp</ins> **CRITICAL** remediate by: 2026-10-03T14:05:15.305Z
- https://github.com/commercelayer/examples/security/dependabot/299

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
> - https://nvd.nist.gov/vuln/detail/CVE-2025-55182
> - https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
> - https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-fmh4-wr37-44fp
> - https://github.com/advisories/GHSA-9qr9-h5gf-34mp
> 
> </details>

`npm-next >= 15.5.0-canary.0, < 15.5.7` CODE_REPOSITORY/examples <ins>GHSA-9qr9-h5gf-34mp</ins> **CRITICAL** remediate by: 2026-10-03T14:05:15.305Z
- https://github.com/commercelayer/examples/security/dependabot/304

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
> - https://nvd.nist.gov/vuln/detail/CVE-2025-55182
> - https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
> - https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-fmh4-wr37-44fp
> - https://github.com/advisories/GHSA-9qr9-h5gf-34mp
> 
> </details>

`npm-next >= 13.0.0, < 13.5.9` CODE_REPOSITORY/examples <ins>CVE-2025-29927</ins> **CRITICAL** remediate by: 2026-10-03T14:05:15.305Z
- https://github.com/commercelayer/examples/security/dependabot/96

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
> - https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2
> - https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48
> - https://nvd.nist.gov/vuln/detail/CVE-2025-29927
> - https://github.com/vercel/next.js/releases/tag/v12.3.5
> - https://github.com/vercel/next.js/releases/tag/v13.5.9
> - https://vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware
> - http://www.openwall.com/lists/oss-security/2025/03/23/3
> - http://www.openwall.com/lists/oss-security/2025/03/23/4
> - https://security.netapp.com/advisory/ntap-20250328-0002
> - https://github.com/advisories/GHSA-f82v-jwr5-mffw
> 
> </details>

`npm-next >= 14.0.0, < 14.2.25` CODE_REPOSITORY/examples <ins>CVE-2025-29927</ins> **CRITICAL** remediate by: 2026-10-03T14:05:15.305Z
- https://github.com/commercelayer/examples/security/dependabot/187

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
> - https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2
> - https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48
> - https://nvd.nist.gov/vuln/detail/CVE-2025-29927
> - https://github.com/vercel/next.js/releases/tag/v12.3.5
> - https://github.com/vercel/next.js/releases/tag/v13.5.9
> - https://vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware
> - http://www.openwall.com/lists/oss-security/2025/03/23/3
> - http://www.openwall.com/lists/oss-security/2025/03/23/4
> - https://security.netapp.com/advisory/ntap-20250328-0002
> - https://github.com/advisories/GHSA-f82v-jwr5-mffw
> 
> </details>

`npm-shell-quote >= 1.1.0, <= 1.8.3` CODE_REPOSITORY/examples <ins>CVE-2026-9277</ins> **CRITICAL** remediate by: 2026-10-03T14:05:15.305Z
- https://github.com/commercelayer/examples/security/dependabot/830

> <details><summary>Related URLs</summary>
> 
> - https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p
> - https://nvd.nist.gov/vuln/detail/CVE-2026-9277
> - https://github.com/ljharb/shell-quote/commit/1518179
> - https://github.com/ljharb/shell-quote
> - https://www.npmjs.com/package/shell-quote
> - http://www.openwall.com/lists/oss-security/2026/05/23/2
> - https://github.com/advisories/GHSA-w7jw-789q-3m8p
> 
> </details>

`npm-form-data >= 4.0.0, < 4.0.4` CODE_REPOSITORY/examples <ins>CVE-2025-7783</ins> **CRITICAL** remediate by: 2026-10-03T14:05:15.305Z
- https://github.com/commercelayer/examples/security/dependabot/213

> <details><summary>Related URLs</summary>
> 
> - https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4
> - https://nvd.nist.gov/vuln/detail/CVE-2025-7783
> - https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0
> - https://github.com/benweissmann/CVE-2025-7783-poc
> - https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html
> - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
> 
> </details>

`npm-form-data < 2.5.4` CODE_REPOSITORY/examples <ins>CVE-2025-7783</ins> **CRITICAL** remediate by: 2026-10-03T14:05:15.305Z
- https://github.com/commercelayer/examples/security/dependabot/216

> <details><summary>Related URLs</summary>
> 
> - https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4
> - https://nvd.nist.gov/vuln/detail/CVE-2025-7783
> - https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0
> - https://github.com/benweissmann/CVE-2025-7783-poc
> - https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html
> - https://github.com/advisories/GHSA-fjxv-7rqg-78g4
> 
> </details>

`npm-h3 <= 1.15.4` CODE_REPOSITORY/examples <ins>CVE-2026-23527</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/329

> <details><summary>Related URLs</summary>
> 
> - https://github.com/h3js/h3/security/advisories/GHSA-mp2g-9vg9-f4cg
> - https://github.com/h3js/h3/releases/tag/v1.15.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-23527
> - https://github.com/h3js/h3/commit/618ccf4f37b8b6148bea7f36040471af45bfb097
> - https://simonkoeck.com/writeups/h3-transfer-encoding-request-smuggling
> - https://github.com/advisories/GHSA-mp2g-9vg9-f4cg
> 
> </details>

`npm-axios >= 1.0.0, < 1.16.0` CODE_REPOSITORY/examples <ins>CVE-2026-44494</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/833

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh
> - https://github.com/advisories/GHSA-fvcv-3m26-pcqx
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44494
> - https://github.com/advisories/GHSA-35jp-ww65-95wh
> 
> </details>

`npm-axios >= 1.0.0, < 1.16.0` CODE_REPOSITORY/examples <ins>CVE-2026-44486</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/810

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc
> - https://github.com/axios/axios/pull/10794
> - https://github.com/axios/axios/commit/afca61a070728e717203c2bc21e7b589b59b858b
> - https://github.com/axios/axios/releases/tag/v0.32.0
> - https://github.com/axios/axios/releases/tag/v1.16.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44486
> - https://github.com/advisories/GHSA-j5f8-grm9-p9fc
> 
> </details>

`npm-axios >= 1.0.0, < 1.16.0` CODE_REPOSITORY/examples <ins>CVE-2026-44496</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/808

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf
> - https://github.com/axios/axios/releases/tag/v0.32.0
> - https://github.com/axios/axios/releases/tag/v1.16.0
> - https://github.com/advisories/GHSA-hfxv-24rg-xrqf
> 
> </details>

`npm-axios >= 1.0.0, < 1.16.0` CODE_REPOSITORY/examples <ins>CVE-2026-44487</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/812

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v
> - https://github.com/axios/axios/releases/tag/v0.32.0
> - https://github.com/axios/axios/releases/tag/v1.16.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44487
> - https://github.com/advisories/GHSA-p92q-9vqr-4j8v
> 
> </details>

`npm-axios >= 1.0.0, < 1.16.0` CODE_REPOSITORY/examples <ins>CVE-2026-44490</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/788

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-898c-q2cr-xwhg
> - https://nvd.nist.gov/vuln/detail/CVE-2018-16487
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44490
> - https://github.com/advisories/GHSA-898c-q2cr-xwhg
> 
> </details>

`npm-next >= 13.4.13, < 15.5.16` CODE_REPOSITORY/examples <ins>CVE-2026-44578</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/717

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r
> - https://github.com/vercel/next.js/releases/tag/v15.5.16
> - https://github.com/vercel/next.js/releases/tag/v16.2.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44578
> - https://github.com/advisories/GHSA-c4j6-fc7j-m34r
> 
> </details>

`npm-axios <= 0.31.1` CODE_REPOSITORY/examples <ins>CVE-2026-44492</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/828

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv
> - https://nvd.nist.gov/vuln/detail/CVE-2025-62718
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44492
> - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json
> - https://bugzilla.redhat.com/show_bug.cgi?id=2487938
> - https://access.redhat.com/security/cve/CVE-2026-44492
> - https://access.redhat.com/errata/RHSA-2026:36108
> - https://access.redhat.com/errata/RHSA-2026:33574
> - https://access.redhat.com/errata/RHSA-2026:33183
> - https://access.redhat.com/errata/RHSA-2026:33173
> - https://access.redhat.com/errata/RHSA-2026:33163
> - https://access.redhat.com/errata/RHSA-2026:33160
> - https://access.redhat.com/errata/RHSA-2026:33155
> - https://access.redhat.com/errata/RHSA-2026:33005
> - https://access.redhat.com/errata/RHSA-2026:30651
> - https://access.redhat.com/errata/RHSA-2026:30650
> - https://access.redhat.com/errata/RHSA-2026:29197
> - https://access.redhat.com/errata/RHSA-2026:29082
> - https://access.redhat.com/errata/RHSA-2026:28964
> - https://access.redhat.com/errata/RHSA-2026:27063
> - https://access.redhat.com/errata/RHSA-2026:27044
> - https://access.redhat.com/errata/RHSA-2026:26234
> - https://access.redhat.com/errata/RHSA-2026:20938
> - https://access.redhat.com/errata/RHSA-2026:20889
> - https://access.redhat.com/errata/RHSA-2026:36883
> - https://access.redhat.com/errata/RHSA-2026:36882
> - https://access.redhat.com/errata/RHSA-2026:36820
> - https://access.redhat.com/errata/RHSA-2026:36754
> - https://access.redhat.com/errata/RHSA-2026:34766
> - https://access.redhat.com/errata/RHSA-2026:36611
> - https://access.redhat.com/errata/RHSA-2026:40119
> - https://access.redhat.com/errata/RHSA-2026:40138
> - https://access.redhat.com/errata/RHSA-2026:40262
> - https://access.redhat.com/errata/RHSA-2026:41031
> - https://access.redhat.com/errata/RHSA-2026:41066
> - https://access.redhat.com/errata/RHSA-2026:41055
> - https://access.redhat.com/errata/RHSA-2026:41064
> - https://github.com/advisories/GHSA-pjwm-pj3p-43mv
> 
> </details>

`npm-axios <= 0.31.1` CODE_REPOSITORY/examples <ins>CVE-2026-44486</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/813

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc
> - https://github.com/axios/axios/pull/10794
> - https://github.com/axios/axios/commit/afca61a070728e717203c2bc21e7b589b59b858b
> - https://github.com/axios/axios/releases/tag/v0.32.0
> - https://github.com/axios/axios/releases/tag/v1.16.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44486
> - https://github.com/advisories/GHSA-j5f8-grm9-p9fc
> 
> </details>

`npm-axios <= 0.31.1` CODE_REPOSITORY/examples <ins>CVE-2026-44496</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/814

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf
> - https://github.com/axios/axios/releases/tag/v0.32.0
> - https://github.com/axios/axios/releases/tag/v1.16.0
> - https://github.com/advisories/GHSA-hfxv-24rg-xrqf
> 
> </details>

`npm-axios <= 0.31.1` CODE_REPOSITORY/examples <ins>CVE-2026-44487</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/815

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v
> - https://github.com/axios/axios/releases/tag/v0.32.0
> - https://github.com/axios/axios/releases/tag/v1.16.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44487
> - https://github.com/advisories/GHSA-p92q-9vqr-4j8v
> 
> </details>

`npm-axios <= 0.31.1` CODE_REPOSITORY/examples <ins>CVE-2026-44490</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/789

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-898c-q2cr-xwhg
> - https://nvd.nist.gov/vuln/detail/CVE-2018-16487
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44490
> - https://github.com/advisories/GHSA-898c-q2cr-xwhg
> 
> </details>

`npm-lodash >= 4.0.0, <= 4.17.23` CODE_REPOSITORY/examples <ins>CVE-2026-4800</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/527

> <details><summary>Related URLs</summary>
> 
> - https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc
> - https://nvd.nist.gov/vuln/detail/CVE-2026-4800
> - https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
> - https://cna.openjsf.org/security-advisories.html
> - https://github.com/advisories/GHSA-35jh-r3h4-6jhm
> - https://github.com/advisories/GHSA-r5fr-rjxr-66jc
> 
> </details>

`npm-next >= 15.4.0, < 15.5.16` CODE_REPOSITORY/examples <ins>CVE-2026-44574</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/661

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv
> - https://github.com/vercel/next.js/releases/tag/v15.5.16
> - https://github.com/vercel/next.js/releases/tag/v16.2.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44574
> - https://github.com/advisories/GHSA-492v-c6pp-mqqv
> 
> </details>

`npm-ws >= 7.0.0, < 7.5.10` CODE_REPOSITORY/examples <ins>CVE-2024-37890</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/73

> <details><summary>Related URLs</summary>
> 
> - https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
> - https://github.com/websockets/ws/issues/2230
> - https://github.com/websockets/ws/pull/2231
> - https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
> - https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
> - https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
> - https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
> - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
> 
> </details>

`npm-path-to-regexp >= 4.0.0, < 6.3.0` CODE_REPOSITORY/examples <ins>CVE-2024-45296</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/83

> <details><summary>Related URLs</summary>
> 
> - https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
> - https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
> - https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
> - https://nvd.nist.gov/vuln/detail/CVE-2024-45296
> - https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485
> - https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef
> - https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894
> - https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0
> - https://security.netapp.com/advisory/ntap-20250124-0001
> - https://github.com/advisories/GHSA-9wv6-86v2-598j
> 
> </details>

`npm-body-parser < 1.20.3` CODE_REPOSITORY/examples <ins>CVE-2024-45590</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/201

> <details><summary>Related URLs</summary>
> 
> - https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7
> - https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce
> - https://nvd.nist.gov/vuln/detail/CVE-2024-45590
> - https://github.com/advisories/GHSA-qwcr-r2fm-qrc7
> 
> </details>

`npm-next >= 9.5.5, < 14.2.15` CODE_REPOSITORY/examples <ins>CVE-2024-51479</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/185

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f
> - https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b
> - https://nvd.nist.gov/vuln/detail/CVE-2024-51479
> - https://github.com/vercel/next.js/releases/tag/v14.2.15
> - https://github.com/advisories/GHSA-7gfc-8cq8-jh5f
> 
> </details>

`npm-cross-spawn >= 7.0.0, < 7.0.5` CODE_REPOSITORY/examples <ins>CVE-2024-21538</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/165

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2024-21538
> - https://github.com/moxystudio/node-cross-spawn/pull/160
> - https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff
> - https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f
> - https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230
> - https://github.com/moxystudio/node-cross-spawn/issues/165
> - https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd
> - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349
> - https://github.com/advisories/GHSA-3xgq-45jj-v275
> 
> </details>

`npm-path-to-regexp < 0.1.10` CODE_REPOSITORY/examples <ins>CVE-2024-45296</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/200

> <details><summary>Related URLs</summary>
> 
> - https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
> - https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
> - https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
> - https://nvd.nist.gov/vuln/detail/CVE-2024-45296
> - https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485
> - https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef
> - https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894
> - https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0
> - https://security.netapp.com/advisory/ntap-20250124-0001
> - https://github.com/advisories/GHSA-9wv6-86v2-598j
> 
> </details>

`npm-path-to-regexp < 0.1.12` CODE_REPOSITORY/examples <ins>CVE-2024-52798</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/206

> <details><summary>Related URLs</summary>
> 
> - https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w
> - https://blakeembrey.com/posts/2024-09-web-redos
> - https://nvd.nist.gov/vuln/detail/CVE-2024-52798
> - https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4
> - https://security.netapp.com/advisory/ntap-20250124-0002
> - https://github.com/advisories/GHSA-rhx6-c78j-4q9w
> 
> </details>

`npm-braces < 3.0.3` CODE_REPOSITORY/examples <ins>CVE-2024-4068</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/158

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2024-4068
> - https://github.com/micromatch/braces/issues/35
> - https://devhub.checkmarx.com/cve-details/CVE-2024-4068
> - https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308
> - https://github.com/micromatch/braces/pull/37
> - https://github.com/micromatch/braces/pull/40
> - https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
> - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
> 
> </details>

`npm-next >= 14.0.0, < 14.2.10` CODE_REPOSITORY/examples <ins>CVE-2024-46982</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/181

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9
> - https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3
> - https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda
> - https://nvd.nist.gov/vuln/detail/CVE-2024-46982
> - https://github.com/advisories/GHSA-gp8f-8m3g-qvj9
> 
> </details>

`npm-axios >= 1.0.0, < 1.12.0` CODE_REPOSITORY/examples <ins>CVE-2025-58754</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/274

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj
> - https://github.com/axios/axios/pull/7011
> - https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593
> - https://github.com/axios/axios/releases/tag/v1.12.0
> - https://nvd.nist.gov/vuln/detail/CVE-2025-58754
> - https://github.com/axios/axios/pull/7034
> - https://github.com/axios/axios/commit/a1b1d3f073a988601583a604f5f9f5d05a3d0b67
> - https://github.com/axios/axios/releases/tag/v0.30.2
> - https://github.com/axios/axios/commit/c30252f685e8f4326722de84923fcbc8cf557f06
> - https://github.com/advisories/GHSA-4hjh-wcwx-xvwj
> 
> </details>

`npm-glob >= 10.2.0, < 10.5.0` CODE_REPOSITORY/examples <ins>CVE-2025-64756</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/290

> <details><summary>Related URLs</summary>
> 
> - https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2
> - https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146
> - https://nvd.nist.gov/vuln/detail/CVE-2025-64756
> - https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f
> - https://github.com/advisories/GHSA-5j98-mcp5-4vw2
> 
> </details>

`npm-jws < 3.2.3` CODE_REPOSITORY/examples <ins>CVE-2025-65945</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/302

> <details><summary>Related URLs</summary>
> 
> - https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x
> - https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e
> - https://github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6
> - https://github.com/auth0/node-jws/releases/tag/v3.2.3
> - https://github.com/auth0/node-jws/releases/tag/v4.0.1
> - https://nvd.nist.gov/vuln/detail/CVE-2025-65945
> - https://github.com/advisories/GHSA-869p-cjfg-cm3x
> 
> </details>

`npm-next >= 15.5.1-canary.0, < 15.5.8` CODE_REPOSITORY/examples <ins>GHSA-mwv6-3258-q52c</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/311

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c
> - https://nextjs.org/blog/security-update-2025-12-11
> - https://www.cve.org/CVERecord?id=CVE-2025-55184
> - https://github.com/advisories/GHSA-mwv6-3258-q52c
> 
> </details>

`npm-next >= 15.5.1-canary.0, < 15.5.8` CODE_REPOSITORY/examples <ins>GHSA-w37m-7fhw-fmv9</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/309

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9
> - https://nextjs.org/blog/security-update-2025-12-11
> - https://www.cve.org/CVERecord?id=CVE-2025-55183
> - https://github.com/advisories/GHSA-w37m-7fhw-fmv9
> 
> </details>

`npm-next >= 15.3.0-canary.0, < 15.3.7` CODE_REPOSITORY/examples <ins>GHSA-mwv6-3258-q52c</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/315

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c
> - https://nextjs.org/blog/security-update-2025-12-11
> - https://www.cve.org/CVERecord?id=CVE-2025-55184
> - https://github.com/advisories/GHSA-mwv6-3258-q52c
> 
> </details>

`npm-next >= 15.3.0-canary.0, < 15.3.7` CODE_REPOSITORY/examples <ins>GHSA-w37m-7fhw-fmv9</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/313

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9
> - https://nextjs.org/blog/security-update-2025-12-11
> - https://www.cve.org/CVERecord?id=CVE-2025-55183
> - https://github.com/advisories/GHSA-w37m-7fhw-fmv9
> 
> </details>

`npm-next >= 13.3.0, < 14.2.34` CODE_REPOSITORY/examples <ins>GHSA-mwv6-3258-q52c</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/317

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c
> - https://nextjs.org/blog/security-update-2025-12-11
> - https://www.cve.org/CVERecord?id=CVE-2025-55184
> - https://github.com/advisories/GHSA-mwv6-3258-q52c
> 
> </details>

`npm-next >= 13.3.1-canary.0, < 14.2.35` CODE_REPOSITORY/examples <ins>GHSA-5j59-xgg2-r9c4</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/319

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4
> - https://nvd.nist.gov/vuln/detail/CVE-2025-67779
> - https://nextjs.org/blog/security-update-2025-12-11
> - https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
> - https://www.cve.org/CVERecord?id=CVE-2025-55184
> - https://www.facebook.com/security/advisories/cve-2025-67779
> - https://github.com/advisories/GHSA-5j59-xgg2-r9c4
> 
> </details>

`npm-next >= 15.5.1-canary.0, < 15.5.10` CODE_REPOSITORY/examples <ins>GHSA-h25m-26qc-wcjf</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/341

> <details><summary>Related URLs</summary>
> 
> - https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg
> - https://github.com/vercel/next.js/security/advisories/GHSA-h25m-26qc-wcjf
> - https://nvd.nist.gov/vuln/detail/CVE-2026-23864
> - https://vercel.com/changelog/summary-of-cve-2026-23864
> - https://github.com/advisories/GHSA-h25m-26qc-wcjf
> 
> </details>

`npm-next >= 15.3.0-canary.0, < 15.3.9` CODE_REPOSITORY/examples <ins>GHSA-h25m-26qc-wcjf</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/343

> <details><summary>Related URLs</summary>
> 
> - https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg
> - https://github.com/vercel/next.js/security/advisories/GHSA-h25m-26qc-wcjf
> - https://nvd.nist.gov/vuln/detail/CVE-2026-23864
> - https://vercel.com/changelog/summary-of-cve-2026-23864
> - https://github.com/advisories/GHSA-h25m-26qc-wcjf
> 
> </details>

`npm-next >= 13.0.0, < 15.0.8` CODE_REPOSITORY/examples <ins>GHSA-h25m-26qc-wcjf</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/357

> <details><summary>Related URLs</summary>
> 
> - https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg
> - https://github.com/vercel/next.js/security/advisories/GHSA-h25m-26qc-wcjf
> - https://nvd.nist.gov/vuln/detail/CVE-2026-23864
> - https://vercel.com/changelog/summary-of-cve-2026-23864
> - https://github.com/advisories/GHSA-h25m-26qc-wcjf
> 
> </details>

`npm-axios <= 0.30.2` CODE_REPOSITORY/examples <ins>CVE-2026-25639</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/400

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433
> - https://github.com/axios/axios/pull/7369
> - https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57
> - https://github.com/axios/axios/releases/tag/v1.13.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-25639
> - https://github.com/axios/axios/pull/7388
> - https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e
> - https://github.com/axios/axios/releases/tag/v0.30.3
> - https://github.com/advisories/GHSA-43fc-jf86-j433
> 
> </details>

`npm-axios >= 1.0.0, <= 1.13.4` CODE_REPOSITORY/examples <ins>CVE-2026-25639</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/399

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433
> - https://github.com/axios/axios/pull/7369
> - https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57
> - https://github.com/axios/axios/releases/tag/v1.13.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-25639
> - https://github.com/axios/axios/pull/7388
> - https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e
> - https://github.com/axios/axios/releases/tag/v0.30.3
> - https://github.com/advisories/GHSA-43fc-jf86-j433
> 
> </details>

`npm-minimatch < 3.1.3` CODE_REPOSITORY/examples <ins>CVE-2026-27903</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/425

> <details><summary>Related URLs</summary>
> 
> - https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
> - https://nvd.nist.gov/vuln/detail/CVE-2026-27903
> - https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
> - https://github.com/advisories/GHSA-7r86-cg39-jmmj
> 
> </details>

`npm-minimatch < 3.1.3` CODE_REPOSITORY/examples <ins>CVE-2026-26996</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/411

> <details><summary>Related URLs</summary>
> 
> - https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
> - https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-26996
> - https://github.com/advisories/GHSA-3ppc-4f35-3m26
> 
> </details>

`npm-minimatch < 3.1.4` CODE_REPOSITORY/examples <ins>CVE-2026-27904</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/432

> <details><summary>Related URLs</summary>
> 
> - https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
> - https://nvd.nist.gov/vuln/detail/CVE-2026-27904
> - https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
> - https://github.com/advisories/GHSA-23c5-xmqv-rm74
> 
> </details>

`npm-minimatch >= 9.0.0, < 9.0.7` CODE_REPOSITORY/examples <ins>CVE-2026-27903</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/436

> <details><summary>Related URLs</summary>
> 
> - https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj
> - https://nvd.nist.gov/vuln/detail/CVE-2026-27903
> - https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748
> - https://github.com/advisories/GHSA-7r86-cg39-jmmj
> 
> </details>

`npm-minimatch >= 9.0.0, < 9.0.7` CODE_REPOSITORY/examples <ins>CVE-2026-27904</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/439

> <details><summary>Related URLs</summary>
> 
> - https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
> - https://nvd.nist.gov/vuln/detail/CVE-2026-27904
> - https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce
> - https://github.com/advisories/GHSA-23c5-xmqv-rm74
> 
> </details>

`npm-h3 < 1.15.6` CODE_REPOSITORY/examples <ins>CVE-2026-33128</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/453

> <details><summary>Related URLs</summary>
> 
> - https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm
> - https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6
> - https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187
> - https://nvd.nist.gov/vuln/detail/CVE-2026-33128
> - https://github.com/advisories/GHSA-22cc-p3c6-wpvm
> 
> </details>

`npm-h3 < 1.15.6` CODE_REPOSITORY/examples <ins>GHSA-wr4h-v87w-p3r7</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/452

> <details><summary>Related URLs</summary>
> 
> - https://github.com/h3js/h3/security/advisories/GHSA-wr4h-v87w-p3r7
> - https://github.com/h3js/h3/commit/0e751b4059060f2ade01a0bdfd96b0f5ffc8a26d
> - https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/static.ts#L86
> - https://github.com/advisories/GHSA-wr4h-v87w-p3r7
> 
> </details>

`npm-picomatch < 2.3.2` CODE_REPOSITORY/examples <ins>CVE-2026-33671</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/490

> <details><summary>Related URLs</summary>
> 
> - https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj
> - https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d
> - https://nvd.nist.gov/vuln/detail/CVE-2026-33671
> - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
> 
> </details>

`npm-picomatch < 2.3.2` CODE_REPOSITORY/examples <ins>CVE-2026-33672</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/496

> <details><summary>Related URLs</summary>
> 
> - https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p
> - https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903
> - https://nvd.nist.gov/vuln/detail/CVE-2026-33672
> - https://github.com/advisories/GHSA-3v7f-55p6-f55p
> 
> </details>

`npm-path-to-regexp < 0.1.13` CODE_REPOSITORY/examples <ins>CVE-2026-4867</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/513

> <details><summary>Related URLs</summary>
> 
> - https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2
> - https://nvd.nist.gov/vuln/detail/CVE-2026-4867
> - https://blakeembrey.com/posts/2024-09-web-redos
> - https://cna.openjsf.org/security-advisories.html
> - https://github.com/advisories/GHSA-9wv6-86v2-598j
> - https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13
> - https://github.com/advisories/GHSA-37ch-88jc-xwx2
> 
> </details>

`npm-defu <= 6.1.4` CODE_REPOSITORY/examples <ins>CVE-2026-35209</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/514

> <details><summary>Related URLs</summary>
> 
> - https://github.com/unjs/defu/security/advisories/GHSA-737v-mqg7-c878
> - https://nvd.nist.gov/vuln/detail/CVE-2026-35209
> - https://github.com/unjs/defu/pull/156
> - https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29
> - https://github.com/unjs/defu/releases/tag/v6.1.5
> - https://github.com/advisories/GHSA-737v-mqg7-c878
> 
> </details>

`npm-next >= 13.0.0, < 15.5.15` CODE_REPOSITORY/examples <ins>GHSA-q4gf-8mx6-v5v3</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/553

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-q4gf-8mx6-v5v3
> - https://vercel.com/changelog/summary-of-cve-2026-23869
> - https://github.com/advisories/GHSA-q4gf-8mx6-v5v3
> 
> </details>

`npm-next >= 15.2.0, < 15.5.18` CODE_REPOSITORY/examples <ins>CVE-2026-45109</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/671

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f
> - https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6
> - https://github.com/vercel/next.js/releases/tag/v15.5.18
> - https://github.com/vercel/next.js/releases/tag/v16.2.6
> - https://nvd.nist.gov/vuln/detail/CVE-2026-45109
> - https://github.com/advisories/GHSA-26hh-7cqf-hhc6
> 
> </details>

`npm-next >= 15.2.0, < 15.5.16` CODE_REPOSITORY/examples <ins>CVE-2026-44575</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/669

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f
> - https://github.com/vercel/next.js/releases/tag/v15.5.16
> - https://github.com/vercel/next.js/releases/tag/v16.2.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44575
> - https://github.com/advisories/GHSA-267c-6grr-h53f
> 
> </details>

`npm-next >= 15.0.0, < 15.5.16` CODE_REPOSITORY/examples <ins>CVE-2026-44579</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/675

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx
> - https://github.com/vercel/next.js/releases/tag/v15.5.16
> - https://github.com/vercel/next.js/releases/tag/v16.2.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44579
> - https://github.com/advisories/GHSA-mg66-mrh9-m8jx
> 
> </details>

`npm-next >= 13.0.0, < 15.5.16` CODE_REPOSITORY/examples <ins>GHSA-8h8q-6873-q5fj</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/729

> <details><summary>Related URLs</summary>
> 
> - https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh
> - https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj
> - https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-w94c-4vhp-22gx
> - https://nvd.nist.gov/vuln/detail/CVE-2026-23870
> - https://github.com/advisories/GHSA-8h8q-6873-q5fj
> 
> </details>

`npm-next >= 13.0.0, < 15.5.16` CODE_REPOSITORY/examples <ins>CVE-2026-44580</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/731

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h
> - https://github.com/vercel/next.js/releases/tag/v15.5.16
> - https://github.com/vercel/next.js/releases/tag/v16.2.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44580
> - https://github.com/advisories/GHSA-gx5p-jg67-6x7h
> 
> </details>

`npm-next >= 12.2.0, < 15.5.16` CODE_REPOSITORY/examples <ins>CVE-2026-44573</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/733

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5
> - https://github.com/vercel/next.js/releases/tag/v15.5.16
> - https://github.com/vercel/next.js/releases/tag/v16.2.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44573
> - https://github.com/advisories/GHSA-36qx-fr4f-26g5
> 
> </details>

`npm-next >= 12.2.0, < 15.5.16` CODE_REPOSITORY/examples <ins>CVE-2026-44572</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/737

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq
> - https://github.com/vercel/next.js/releases/tag/v15.5.16
> - https://github.com/vercel/next.js/releases/tag/v16.2.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44572
> - https://github.com/advisories/GHSA-3g8h-86w9-wvmq
> 
> </details>

`npm-js-cookie <= 3.0.5` CODE_REPOSITORY/examples <ins>CVE-2026-46625</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/747

> <details><summary>Related URLs</summary>
> 
> - https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j
> - https://nvd.nist.gov/vuln/detail/CVE-2026-46625
> - https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020
> - https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7
> - https://github.com/advisories/GHSA-qjx8-664m-686j
> 
> </details>

`npm-axios >= 1.7.0, < 1.16.0` CODE_REPOSITORY/examples <ins>CVE-2026-44488</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/793

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf
> - https://github.com/axios/axios/pull/10795
> - https://github.com/axios/axios/pull/10796
> - https://github.com/axios/axios/releases/tag/v1.16.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44488
> - https://github.com/advisories/GHSA-777c-7fjr-54vf
> 
> </details>

`npm-form-data >= 4.0.0, < 4.0.6` CODE_REPOSITORY/examples <ins>CVE-2026-12143</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/863

> <details><summary>Related URLs</summary>
> 
> - https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx
> - https://nvd.nist.gov/vuln/detail/CVE-2026-12143
> - https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435
> - https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229
> - https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045
> - https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data
> - https://www.npmjs.com/package/form-data
> - https://github.com/advisories/GHSA-hmw2-7cc7-3qxx
> 
> </details>

`npm-vite >= 8.0.0, <= 8.0.15` CODE_REPOSITORY/examples <ins>CVE-2026-53571</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/848

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff
> - https://nvd.nist.gov/vuln/detail/CVE-2026-53571
> - https://github.com/advisories/GHSA-fx2h-pf6j-xcff
> 
> </details>

`npm-vite >= 8.0.0, <= 8.0.15` CODE_REPOSITORY/examples <ins>CVE-2026-53632</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/849

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3
> - https://github.com/advisories/GHSA-v6wh-96g9-6wx3
> 
> </details>

`npm-ws >= 7.0.0, < 7.5.11` CODE_REPOSITORY/examples <ins>CVE-2026-48779</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/850

> <details><summary>Related URLs</summary>
> 
> - https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p
> - https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7
> - https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53
> - https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94
> - https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8
> - https://nvd.nist.gov/vuln/detail/CVE-2026-48779
> - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json
> - https://bugzilla.redhat.com/show_bug.cgi?id=2489661
> - https://access.redhat.com/security/cve/CVE-2026-48779
> - https://access.redhat.com/errata/RHSA-2026:34342
> - https://access.redhat.com/errata/RHSA-2026:33574
> - https://access.redhat.com/errata/RHSA-2026:33183
> - https://access.redhat.com/errata/RHSA-2026:33173
> - https://access.redhat.com/errata/RHSA-2026:33163
> - https://access.redhat.com/errata/RHSA-2026:33160
> - https://access.redhat.com/errata/RHSA-2026:33155
> - https://access.redhat.com/errata/RHSA-2026:29197
> - https://access.redhat.com/errata/RHSA-2026:36820
> - https://access.redhat.com/errata/RHSA-2026:36754
> - https://access.redhat.com/errata/RHSA-2026:37272
> - https://access.redhat.com/errata/RHSA-2026:27171
> - https://access.redhat.com/errata/RHSA-2026:26638
> - https://github.com/advisories/GHSA-96hv-2xvq-fx4p
> 
> </details>

`npm-form-data < 2.5.6` CODE_REPOSITORY/examples <ins>CVE-2026-12143</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/859

> <details><summary>Related URLs</summary>
> 
> - https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx
> - https://nvd.nist.gov/vuln/detail/CVE-2026-12143
> - https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435
> - https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229
> - https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045
> - https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data
> - https://www.npmjs.com/package/form-data
> - https://github.com/advisories/GHSA-hmw2-7cc7-3qxx
> 
> </details>

`npm-shell-quote <= 1.8.4` CODE_REPOSITORY/examples <ins>CVE-2026-13311</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/935

> <details><summary>Related URLs</summary>
> 
> - https://github.com/ljharb/shell-quote/security/advisories/GHSA-395f-4hp3-45gv
> - https://nvd.nist.gov/vuln/detail/CVE-2026-13311
> - https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec
> - https://github.com/ljharb/shell-quote/releases/tag/v1.9.0
> - https://www.npmjs.com/package/shell-quote
> - https://github.com/advisories/GHSA-395f-4hp3-45gv
> 
> </details>

`npm-postcss <= 8.5.11` CODE_REPOSITORY/examples <ins>CVE-2026-45623</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1002

> <details><summary>Related URLs</summary>
> 
> - https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q
> - https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad
> - https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3
> - https://github.com/postcss/postcss/releases/tag/8.5.12
> - https://github.com/advisories/GHSA-6g55-p6wh-862q
> 
> </details>

`npm-postcss <= 8.5.17` CODE_REPOSITORY/examples <ins>CVE-2026-73646</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1032

> <details><summary>Related URLs</summary>
> 
> - https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849
> - https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c
> - https://github.com/postcss/postcss/releases/tag/8.5.18
> - https://github.com/advisories/GHSA-r28c-9q8g-f849
> 
> </details>

`npm-brace-expansion >= 2.0.0, < 2.1.3` CODE_REPOSITORY/examples <ins>CVE-2026-14257</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1030

> <details><summary>Related URLs</summary>
> 
> - https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg
> - https://nvd.nist.gov/vuln/detail/CVE-2026-14257
> - https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5
> - https://github.com/juliangruber/brace-expansion
> - https://www.npmjs.com/package/brace-expansion
> - https://github.com/juliangruber/brace-expansion/pull/129
> - https://github.com/juliangruber/brace-expansion/pull/130
> - https://github.com/juliangruber/brace-expansion/pull/136
> - https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
> - https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
> - https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb
> - https://github.com/advisories/GHSA-mh99-v99m-4gvg
> 
> </details>



Navigation Menu

Uh oh!

[VANTA] [VULNERABILITY] <CRITICAL> CVE-2024-21538, CVE-2024-37890, CVE-2024-4068 and others, fix before 2026-10-03 #38

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

[VANTA] [VULNERABILITY] <CRITICAL> CVE-2024-21538, CVE-2024-37890, CVE-2024-4068 and others, fix before 2026-10-03 #38

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions