[VANTA] [VULNERABILITY] <HIGH> CVE-2023-26159, CVE-2023-45857, CVE-2024-28849 and others, fix before 2026-10-03

> [!IMPORTANT]
> CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.
>
> DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

`npm-brace-expansion >= 2.0.0, < 2.1.4` CODE_REPOSITORY/examples <ins>CVE-2026-69152</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1036

> <details><summary>Related URLs</summary>
> 
> - https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895
> - https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
> - https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
> - https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
> - https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
> - https://nvd.nist.gov/vuln/detail/CVE-2026-69152
> - https://github.com/advisories/GHSA-rgw5-rvv9-x895
> 
> </details>

`npm-brace-expansion < 1.1.17` CODE_REPOSITORY/examples <ins>CVE-2026-14257</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1050

> <details><summary>Related URLs</summary>
> 
> - https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg
> - https://nvd.nist.gov/vuln/detail/CVE-2026-14257
> - https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5
> - https://github.com/juliangruber/brace-expansion
> - https://www.npmjs.com/package/brace-expansion
> - https://github.com/juliangruber/brace-expansion/pull/129
> - https://github.com/juliangruber/brace-expansion/pull/130
> - https://github.com/juliangruber/brace-expansion/pull/136
> - https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
> - https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
> - https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb
> - https://github.com/advisories/GHSA-mh99-v99m-4gvg
> 
> </details>

`npm-brace-expansion < 1.1.18` CODE_REPOSITORY/examples <ins>CVE-2026-69152</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1089

> <details><summary>Related URLs</summary>
> 
> - https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895
> - https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
> - https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
> - https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
> - https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
> - https://nvd.nist.gov/vuln/detail/CVE-2026-69152
> - https://github.com/advisories/GHSA-rgw5-rvv9-x895
> 
> </details>

`npm-browserslist <= 4.28.6` CODE_REPOSITORY/examples <ins>CVE-2026-73088</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1095

> <details><summary>Related URLs</summary>
> 
> - https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g
> - https://nvd.nist.gov/vuln/detail/CVE-2026-73088
> - https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51
> - https://github.com/browserslist/browserslist/releases/tag/4.28.7
> - https://github.com/advisories/GHSA-73wf-gq98-2v4g
> 
> </details>

`npm-browserslist <= 4.28.6` CODE_REPOSITORY/examples <ins>CVE-2026-73089</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1096

> <details><summary>Related URLs</summary>
> 
> - https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx
> - https://nvd.nist.gov/vuln/detail/CVE-2026-73089
> - https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405
> - https://github.com/browserslist/browserslist/releases/tag/4.28.7
> - https://github.com/advisories/GHSA-c83g-rgw3-j3cx
> 
> </details>

`npm-axios <= 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2026-42033</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/762

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42033
> - https://github.com/advisories/GHSA-pf86-5x62-jrwf
> 
> </details>

`npm-axios <= 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2026-42035</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/723

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42035
> - https://github.com/advisories/GHSA-6chq-wfr3-2hj9
> 
> </details>

`npm-axios <= 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2026-42043</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/647

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42043
> - https://github.com/advisories/GHSA-pmwg-cvhr-8vh7
> 
> </details>

`npm-axios <= 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2026-42039</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/651

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42039
> - https://github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f
> - https://github.com/axios/axios/releases/tag/v1.15.1
> - https://github.com/advisories/GHSA-62hf-57xw-28j9
> 
> </details>

`npm-axios <= 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2026-42038</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/650

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42038
> - https://github.com/advisories/GHSA-m7pr-hjqh-92cm
> 
> </details>

`npm-axios <= 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2026-42042</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/648

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42042
> - https://github.com/advisories/GHSA-xx6v-rp6x-q39c
> 
> </details>

`npm-axios <= 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2026-42036</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/713

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42036
> - https://github.com/advisories/GHSA-vf2m-468p-8v99
> 
> </details>

`npm-axios <= 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2026-42034</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/649

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-5c9x-8gcm-mpgx
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42034
> - https://github.com/advisories/GHSA-5c9x-8gcm-mpgx
> 
> </details>

`npm-axios <= 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2026-42041</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/712

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42041
> - https://github.com/advisories/GHSA-w9j2-pvgh-6h63
> 
> </details>

`npm-axios <= 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2026-42040</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/646

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42040
> - https://github.com/advisories/GHSA-xhjh-pmcv-23jw
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.2` CODE_REPOSITORY/examples <ins>CVE-2026-42264</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/627

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42264
> - https://github.com/axios/axios/pull/10779
> - https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa
> - https://github.com/axios/axios/releases/tag/v1.15.2
> - https://github.com/advisories/GHSA-q8qp-cvcw-x6jj
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.2` CODE_REPOSITORY/examples <ins>CVE-2026-44495</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/821

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44495
> - https://github.com/advisories/GHSA-3g43-6gmg-66jw
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.2` CODE_REPOSITORY/examples <ins>CVE-2026-42044</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/631

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42044
> - https://github.com/advisories/GHSA-3w6x-2g7m-8v23
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-42035</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/633

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42035
> - https://github.com/advisories/GHSA-6chq-wfr3-2hj9
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-42033</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/637

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42033
> - https://github.com/advisories/GHSA-pf86-5x62-jrwf
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-42043</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/711

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42043
> - https://github.com/advisories/GHSA-pmwg-cvhr-8vh7
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-42039</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/641

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42039
> - https://github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f
> - https://github.com/axios/axios/releases/tag/v1.15.1
> - https://github.com/advisories/GHSA-62hf-57xw-28j9
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-42038</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/639

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42038
> - https://github.com/advisories/GHSA-m7pr-hjqh-92cm
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-42042</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/709

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42042
> - https://github.com/advisories/GHSA-xx6v-rp6x-q39c
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-42036</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/635

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42036
> - https://github.com/advisories/GHSA-vf2m-468p-8v99
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-42034</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/645

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-5c9x-8gcm-mpgx
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42034
> - https://github.com/advisories/GHSA-5c9x-8gcm-mpgx
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-42037</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/643

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-445q-vr5w-6q77
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42037
> - https://github.com/advisories/GHSA-445q-vr5w-6q77
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-42041</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/773

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42041
> - https://github.com/advisories/GHSA-w9j2-pvgh-6h63
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-42040</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/629

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw
> - https://nvd.nist.gov/vuln/detail/CVE-2026-42040
> - https://github.com/advisories/GHSA-xhjh-pmcv-23jw
> 
> </details>

`npm-nanoid < 3.3.12` CODE_REPOSITORY/examples <ins>CVE-2026-73086</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1098

> <details><summary>Related URLs</summary>
> 
> - https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w
> - https://nvd.nist.gov/vuln/detail/CVE-2026-73086
> - https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4
> - https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3
> - https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac
> - https://github.com/ai/nanoid/releases/tag/3.3.12
> - https://github.com/ai/nanoid/releases/tag/5.1.11
> - https://github.com/advisories/GHSA-xwg4-73v4-xw9w
> 
> </details>

`npm-hono < 4.12.25` CODE_REPOSITORY/examples <ins>CVE-2026-54290</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/855

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc
> - https://nvd.nist.gov/vuln/detail/CVE-2026-54290
> - https://github.com/advisories/GHSA-88fw-hqm2-52qc
> 
> </details>

`npm-hono < 4.12.25` CODE_REPOSITORY/examples <ins>CVE-2026-54288</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/857

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-rv63-4mwf-qqc2
> - https://nvd.nist.gov/vuln/detail/CVE-2026-54288
> - https://github.com/advisories/GHSA-rv63-4mwf-qqc2
> 
> </details>

`npm-hono < 4.12.25` CODE_REPOSITORY/examples <ins>CVE-2026-54286</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/854

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44
> - https://nvd.nist.gov/vuln/detail/CVE-2026-54286
> - https://github.com/advisories/GHSA-wwfh-h76j-fc44
> 
> </details>

`npm-hono < 4.12.25` CODE_REPOSITORY/examples <ins>CVE-2026-54287</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/853

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-j6c9-x7qj-28xf
> - https://nvd.nist.gov/vuln/detail/CVE-2026-54287
> - https://github.com/advisories/GHSA-j6c9-x7qj-28xf
> 
> </details>

`npm-hono < 4.12.25` CODE_REPOSITORY/examples <ins>CVE-2026-54289</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/856

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-wgpf-jwqj-8h8p
> - https://nvd.nist.gov/vuln/detail/CVE-2026-54289
> - https://github.com/advisories/GHSA-wgpf-jwqj-8h8p
> 
> </details>

`npm-axios >= 0.19.0, < 0.31.1` CODE_REPOSITORY/examples <ins>CVE-2026-44495</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/823

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44495
> - https://github.com/advisories/GHSA-3g43-6gmg-66jw
> 
> </details>

`npm-nanoid < 3.3.16` CODE_REPOSITORY/examples <ins>CVE-2026-67214</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1069

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2026-67214
> - https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49
> - https://github.com/ai/nanoid/releases/tag/5.1.16
> - https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
> - https://github.com/ai/nanoid/pull/600
> - https://github.com/ai/nanoid/pull/601
> - https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d
> - https://github.com/advisories/GHSA-28wg-ghj8-5hjv
> 
> </details>

`npm-nanoid < 3.3.18` CODE_REPOSITORY/examples <ins>CVE-2026-67213</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1076

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2026-67213
> - https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7
> - https://github.com/ai/nanoid/releases/tag/5.1.6
> - https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom
> - https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b
> - https://github.com/ai/nanoid/releases/tag/3.3.17
> - https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0
> - https://github.com/ai/nanoid/releases/tag/3.3.18
> - https://github.com/advisories/GHSA-2v37-7h3g-55p8
> 
> </details>

`npm-brace-expansion >= 2.0.0, < 2.1.2` CODE_REPOSITORY/examples <ins>CVE-2026-13149</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/888

> <details><summary>Related URLs</summary>
> 
> - https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp
> - https://nvd.nist.gov/vuln/detail/CVE-2026-13149
> - https://github.com/juliangruber/brace-expansion/pull/122
> - https://github.com/juliangruber/brace-expansion/pull/123
> - https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265
> - https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754
> - https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95
> - https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16
> - https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2
> - https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7
> - https://www.npmjs.com/package/brace-expansion
> - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
> 
> </details>

`npm-brace-expansion < 1.1.16` CODE_REPOSITORY/examples <ins>CVE-2026-13149</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/959

> <details><summary>Related URLs</summary>
> 
> - https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp
> - https://nvd.nist.gov/vuln/detail/CVE-2026-13149
> - https://github.com/juliangruber/brace-expansion/pull/122
> - https://github.com/juliangruber/brace-expansion/pull/123
> - https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265
> - https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754
> - https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95
> - https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16
> - https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2
> - https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7
> - https://www.npmjs.com/package/brace-expansion
> - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
> 
> </details>

`npm-axios >= 1.3.2, <= 1.7.3` CODE_REPOSITORY/examples <ins>CVE-2024-39338</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/199

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2024-39338
> - https://github.com/axios/axios/releases
> - https://jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.html
> - https://github.com/axios/axios/issues/6463
> - https://github.com/axios/axios/pull/6539
> - https://github.com/axios/axios/pull/6543
> - https://github.com/axios/axios/commit/6b6b605eaf73852fb2dae033f1e786155959de3a
> - https://github.com/axios/axios/releases/tag/v1.7.4
> - https://github.com/advisories/GHSA-8hc4-vh64-cxmj
> 
> </details>

`npm-axios >= 1.0.0, < 1.8.2` CODE_REPOSITORY/examples <ins>CVE-2025-27152</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/207

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6
> - https://github.com/axios/axios/issues/6463
> - https://github.com/axios/axios/commit/fb8eec214ce7744b5ca787f2c3b8339b2f54b00f
> - https://github.com/axios/axios/releases/tag/v1.8.2
> - https://nvd.nist.gov/vuln/detail/CVE-2025-27152
> - https://github.com/axios/axios/pull/6829
> - https://github.com/axios/axios/commit/02c3c69ced0f8fd86407c23203835892313d7fde
> - https://github.com/advisories/GHSA-jr5f-v2jv-69x6
> 
> </details>

`npm-axios < 0.30.0` CODE_REPOSITORY/examples <ins>CVE-2025-27152</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/150

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6
> - https://github.com/axios/axios/issues/6463
> - https://github.com/axios/axios/commit/fb8eec214ce7744b5ca787f2c3b8339b2f54b00f
> - https://github.com/axios/axios/releases/tag/v1.8.2
> - https://nvd.nist.gov/vuln/detail/CVE-2025-27152
> - https://github.com/axios/axios/pull/6829
> - https://github.com/axios/axios/commit/02c3c69ced0f8fd86407c23203835892313d7fde
> - https://github.com/advisories/GHSA-jr5f-v2jv-69x6
> 
> </details>

`npm-minimatch >= 9.0.0, < 9.0.6` CODE_REPOSITORY/examples <ins>CVE-2026-26996</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/415

> <details><summary>Related URLs</summary>
> 
> - https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
> - https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-26996
> - https://github.com/advisories/GHSA-3ppc-4f35-3m26
> 
> </details>

`npm-rollup >= 4.0.0, < 4.59.0` CODE_REPOSITORY/examples <ins>CVE-2026-27606</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/421

> <details><summary>Related URLs</summary>
> 
> - https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc
> - https://nvd.nist.gov/vuln/detail/CVE-2026-27606
> - https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2
> - https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e
> - https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3
> - https://github.com/rollup/rollup/releases/tag/v2.80.0
> - https://github.com/rollup/rollup/releases/tag/v3.30.0
> - https://github.com/rollup/rollup/releases/tag/v4.59.0
> - https://github.com/advisories/GHSA-mw96-cpmx-2vgc
> 
> </details>

`npm-sharp < 0.35.0` CODE_REPOSITORY/examples <ins>GHSA-f88m-g3jw-g9cj</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/938

> <details><summary>Related URLs</summary>
> 
> - https://github.com/libvips/libvips/security/advisories/GHSA-2fcj-gj27-279x
> - https://github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76
> - https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm
> - https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7
> - https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj
> - https://github.com/advisories/GHSA-f88m-g3jw-g9cj
> 
> </details>

`npm-next >= 14.1.1, < 15.5.21` CODE_REPOSITORY/examples <ins>CVE-2026-64649</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1001

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x
> - https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b
> - https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498
> - https://github.com/vercel/next.js/releases/tag/v15.5.21
> - https://github.com/vercel/next.js/releases/tag/v16.2.11
> - https://github.com/advisories/GHSA-89xv-2m56-2m9x
> 
> </details>

`npm-react-router >= 7.0.0, < 7.18.0` CODE_REPOSITORY/examples <ins>CVE-2026-55685</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/957

> <details><summary>Related URLs</summary>
> 
> - https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5
> - https://github.com/remix-run/react-router/pull/15186
> - https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929
> - https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
> - https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
> - https://github.com/advisories/GHSA-chx6-hx7r-mcp5
> 
> </details>

`npm-next >= 13.0.0, < 15.5.21` CODE_REPOSITORY/examples <ins>CVE-2026-64641</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1021

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj
> - https://github.com/vercel/next.js/pull/96013
> - https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12
> - https://github.com/vercel/next.js/releases/tag/v15.5.21
> - https://github.com/vercel/next.js/releases/tag/v16.2.11
> - https://github.com/advisories/GHSA-m99w-x7hq-7vfj
> 
> </details>

`npm-next >= 13.0.0, < 15.5.21` CODE_REPOSITORY/examples <ins>CVE-2026-64643</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/1019

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp
> - https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3
> - https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b
> - https://github.com/vercel/next.js/releases/tag/v15.5.21
> - https://github.com/vercel/next.js/releases/tag/v16.2.11
> - https://github.com/advisories/GHSA-955p-x3mx-jcvp
> 
> </details>

`npm-next >= 13.0.0, < 15.5.21` CODE_REPOSITORY/examples <ins>CVE-2026-64646</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/1023

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3
> - https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4
> - https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17
> - https://github.com/vercel/next.js/releases/tag/v15.5.21
> - https://github.com/vercel/next.js/releases/tag/v16.2.11
> - https://github.com/advisories/GHSA-4c39-4ccg-62r3
> 
> </details>

`npm-next >= 13.0.0, < 15.5.21` CODE_REPOSITORY/examples <ins>CVE-2026-64648</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/1017

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742
> - https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c
> - https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a
> - https://github.com/vercel/next.js/releases/tag/v15.5.21
> - https://github.com/vercel/next.js/releases/tag/v16.2.11
> - https://github.com/advisories/GHSA-68g3-v927-f742
> 
> </details>

`npm-next >= 13.0.0, < 15.5.21` CODE_REPOSITORY/examples <ins>CVE-2026-64647</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/1015

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q
> - https://github.com/vercel/next.js/pull/96008
> - https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082
> - https://github.com/vercel/next.js/releases/tag/v15.5.21
> - https://github.com/vercel/next.js/releases/tag/v16.2.11
> - https://github.com/advisories/GHSA-4633-3j49-mh5q
> 
> </details>

`npm-next >= 12.0.0, < 15.5.21` CODE_REPOSITORY/examples <ins>CVE-2026-64645</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1027

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4
> - https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9
> - https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599
> - https://github.com/vercel/next.js/releases/tag/v15.5.21
> - https://github.com/vercel/next.js/releases/tag/v16.2.11
> - https://github.com/advisories/GHSA-p9j2-gv94-2wf4
> 
> </details>

`npm-react-router >= 7.12.0, < 7.18.2` CODE_REPOSITORY/examples <ins>GHSA-qwww-vcr4-c8h2</ins> **HIGH** remediate by: 2026-10-03T14:05:19.404Z
- https://github.com/commercelayer/examples/security/dependabot/1052

> <details><summary>Related URLs</summary>
> 
> - https://github.com/remix-run/react-router/security/advisories/GHSA-qwww-vcr4-c8h2
> - https://github.com/remix-run/react-router/commit/7a71c728ad116bd78699a258b2014ce9585729f5
> - https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830
> - https://github.com/remix-run/react-router/releases/tag/react-router@8.3.0
> - http://github.com/remix-run/react-router/pull/15311
> - https://github.com/remix-run/react-router/pull/15353
> - https://github.com/remix-run/react-router/commit/8ebd5df9932854547963e3255c8454e62430e05d
> - https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182
> - https://github.com/remix-run/react-router/releases/tag/react-router%407.18.2
> - https://github.com/advisories/GHSA-qwww-vcr4-c8h2
> 
> </details>

`npm-uuid < 11.1.1` CODE_REPOSITORY/examples <ins>CVE-2026-41907</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/754

> <details><summary>Related URLs</summary>
> 
> - https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq
> - https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34
> - https://github.com/uuidjs/uuid/releases/tag/v14.0.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-41907
> - https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e
> - https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d
> - https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a
> - https://github.com/uuidjs/uuid/releases/tag/v11.1.1
> - https://github.com/uuidjs/uuid/releases/tag/v12.0.1
> - https://github.com/uuidjs/uuid/releases/tag/v13.0.1
> - https://github.com/advisories/GHSA-w5hq-g745-h8pq
> 
> </details>

`npm-react-router >= 7.11.0, < 7.18.0` CODE_REPOSITORY/examples <ins>CVE-2026-53667</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/949

> <details><summary>Related URLs</summary>
> 
> - https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh
> - https://github.com/remix-run/react-router/pull/15177
> - https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242
> - https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
> - https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
> - https://github.com/advisories/GHSA-h8fp-f39c-q6mh
> 
> </details>

`npm-axios >= 1.0.0, < 1.6.0` CODE_REPOSITORY/examples <ins>CVE-2023-45857</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/49

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2023-45857
> - https://github.com/axios/axios/issues/6006
> - https://github.com/axios/axios/issues/6022
> - https://github.com/axios/axios/pull/6028
> - https://github.com/axios/axios/commit/96ee232bd3ee4de2e657333d4d2191cd389e14d0
> - https://github.com/axios/axios/releases/tag/v1.6.0
> - https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459
> - https://github.com/axios/axios/pull/6091
> - https://github.com/axios/axios/commit/2755df562b9c194fba6d8b609a383443f6a6e967
> - https://github.com/axios/axios/releases/tag/v0.28.0
> - https://security.netapp.com/advisory/ntap-20240621-0006
> - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
> 
> </details>

`npm-axios >= 0.8.1, < 0.28.0` CODE_REPOSITORY/examples <ins>CVE-2023-45857</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/54

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2023-45857
> - https://github.com/axios/axios/issues/6006
> - https://github.com/axios/axios/issues/6022
> - https://github.com/axios/axios/pull/6028
> - https://github.com/axios/axios/commit/96ee232bd3ee4de2e657333d4d2191cd389e14d0
> - https://github.com/axios/axios/releases/tag/v1.6.0
> - https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459
> - https://github.com/axios/axios/pull/6091
> - https://github.com/axios/axios/commit/2755df562b9c194fba6d8b609a383443f6a6e967
> - https://github.com/axios/axios/releases/tag/v0.28.0
> - https://security.netapp.com/advisory/ntap-20240621-0006
> - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
> 
> </details>

`npm-follow-redirects <= 1.15.5` CODE_REPOSITORY/examples <ins>CVE-2024-28849</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/62

> <details><summary>Related URLs</summary>
> 
> - https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp
> - https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b
> - https://fetch.spec.whatwg.org/#authentication-entries
> - https://nvd.nist.gov/vuln/detail/CVE-2024-28849
> - https://github.com/psf/requests/issues/1885
> - https://hackerone.com/reports/2390009
> - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z
> - https://github.com/advisories/GHSA-cxjh-pqwp-8mfp
> 
> </details>

`npm-next >= 15.0.0-canary.0, < 15.4.7` CODE_REPOSITORY/examples <ins>CVE-2025-57822</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/224

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f
> - https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8
> - https://vercel.com/changelog/cve-2025-57822
> - https://nvd.nist.gov/vuln/detail/CVE-2025-57822
> - https://github.com/advisories/GHSA-4342-x723-ch2f
> 
> </details>

`npm-next >= 0.9.9, < 14.2.32` CODE_REPOSITORY/examples <ins>CVE-2025-57822</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/255

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f
> - https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8
> - https://vercel.com/changelog/cve-2025-57822
> - https://nvd.nist.gov/vuln/detail/CVE-2025-57822
> - https://github.com/advisories/GHSA-4342-x723-ch2f
> 
> </details>

`npm-lodash >= 4.0.0, <= 4.17.22` CODE_REPOSITORY/examples <ins>CVE-2025-13465</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/339

> <details><summary>Related URLs</summary>
> 
> - https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
> - https://nvd.nist.gov/vuln/detail/CVE-2025-13465
> - https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81
> - https://cert-portal.siemens.com/productcert/html/ssa-253495.html
> - https://github.com/advisories/GHSA-xxjr-mmjv-4gpg
> 
> </details>

`npm-brace-expansion >= 2.0.0, < 2.0.3` CODE_REPOSITORY/examples <ins>CVE-2026-33750</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/502

> <details><summary>Related URLs</summary>
> 
> - https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v
> - https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
> - https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184
> - https://github.com/juliangruber/brace-expansion/issues/98
> - https://github.com/juliangruber/brace-expansion/pull/95
> - https://github.com/juliangruber/brace-expansion/pull/96
> - https://github.com/juliangruber/brace-expansion/pull/97
> - https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
> - https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
> - https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
> - https://nvd.nist.gov/vuln/detail/CVE-2026-33750
> - https://github.com/advisories/GHSA-f886-m6hf-6m8v
> 
> </details>

`npm-lodash <= 4.17.23` CODE_REPOSITORY/examples <ins>CVE-2026-2950</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/522

> <details><summary>Related URLs</summary>
> 
> - https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
> - https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
> - https://nvd.nist.gov/vuln/detail/CVE-2026-2950
> - https://github.com/advisories/GHSA-f23m-r3pf-42rh
> 
> </details>

`npm-brace-expansion < 1.1.13` CODE_REPOSITORY/examples <ins>CVE-2026-33750</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/770

> <details><summary>Related URLs</summary>
> 
> - https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v
> - https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
> - https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184
> - https://github.com/juliangruber/brace-expansion/issues/98
> - https://github.com/juliangruber/brace-expansion/pull/95
> - https://github.com/juliangruber/brace-expansion/pull/96
> - https://github.com/juliangruber/brace-expansion/pull/97
> - https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
> - https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
> - https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
> - https://nvd.nist.gov/vuln/detail/CVE-2026-33750
> - https://github.com/advisories/GHSA-f886-m6hf-6m8v
> 
> </details>

`npm-hono >= 4.11.8, < 4.12.27` CODE_REPOSITORY/examples <ins>CVE-2026-59896</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/916

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-hvrm-45r6-mjfj
> - https://nvd.nist.gov/vuln/detail/CVE-2026-59896
> - https://github.com/honojs/hono/commit/fab3b13639339cbd5ba1166a5b23d9ac30c5f64f
> - https://github.com/honojs/hono/releases/tag/v4.12.27
> - https://github.com/advisories/GHSA-hvrm-45r6-mjfj
> 
> </details>

`npm-@babel/helpers < 7.26.10` CODE_REPOSITORY/examples <ins>CVE-2025-27789</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/94

> <details><summary>Related URLs</summary>
> 
> - https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8
> - https://github.com/babel/babel/pull/17173
> - https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4
> - https://nvd.nist.gov/vuln/detail/CVE-2025-27789
> - https://github.com/advisories/GHSA-968p-4wvh-cqc8
> 
> </details>

`npm-@babel/runtime-corejs3 < 7.26.10` CODE_REPOSITORY/examples <ins>CVE-2025-27789</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/95

> <details><summary>Related URLs</summary>
> 
> - https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8
> - https://github.com/babel/babel/pull/17173
> - https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4
> - https://nvd.nist.gov/vuln/detail/CVE-2025-27789
> - https://github.com/advisories/GHSA-968p-4wvh-cqc8
> 
> </details>

`npm-@babel/runtime < 7.26.10` CODE_REPOSITORY/examples <ins>CVE-2025-27789</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/144

> <details><summary>Related URLs</summary>
> 
> - https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8
> - https://github.com/babel/babel/pull/17173
> - https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4
> - https://nvd.nist.gov/vuln/detail/CVE-2025-27789
> - https://github.com/advisories/GHSA-968p-4wvh-cqc8
> 
> </details>

`npm-next >= 15.0.0, <= 15.4.4` CODE_REPOSITORY/examples <ins>CVE-2025-57752</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/222

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v
> - https://github.com/vercel/next.js/pull/82114
> - https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
> - https://vercel.com/changelog/cve-2025-57752
> - https://nvd.nist.gov/vuln/detail/CVE-2025-57752
> - https://github.com/advisories/GHSA-g5qg-72qw-gw5v
> 
> </details>

`npm-next >= 15.0.0, <= 15.4.4` CODE_REPOSITORY/examples <ins>CVE-2025-55173</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/220

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v
> - https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
> - http://vercel.com/changelog/cve-2025-55173
> - https://nvd.nist.gov/vuln/detail/CVE-2025-55173
> - https://vercel.com/changelog/cve-2025-55173
> - https://github.com/advisories/GHSA-xv57-4mr9-wg8v
> 
> </details>

`npm-next >= 0.9.9, < 14.2.31` CODE_REPOSITORY/examples <ins>CVE-2025-57752</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/244

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v
> - https://github.com/vercel/next.js/pull/82114
> - https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
> - https://vercel.com/changelog/cve-2025-57752
> - https://nvd.nist.gov/vuln/detail/CVE-2025-57752
> - https://github.com/advisories/GHSA-g5qg-72qw-gw5v
> 
> </details>

`npm-next >= 0.9.9, < 14.2.31` CODE_REPOSITORY/examples <ins>CVE-2025-55173</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/258

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v
> - https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
> - http://vercel.com/changelog/cve-2025-55173
> - https://nvd.nist.gov/vuln/detail/CVE-2025-55173
> - https://vercel.com/changelog/cve-2025-55173
> - https://github.com/advisories/GHSA-xv57-4mr9-wg8v
> 
> </details>

`npm-follow-redirects < 1.15.4` CODE_REPOSITORY/examples <ins>CVE-2023-26159</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/34

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2023-26159
> - https://github.com/follow-redirects/follow-redirects/issues/235
> - https://github.com/follow-redirects/follow-redirects/pull/236
> - https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137
> - https://github.com/follow-redirects/follow-redirects/commit/7a6567e16dfa9ad18a70bfe91784c28653fbf19d
> - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM
> - https://security.netapp.com/advisory/ntap-20241108-0002
> - https://github.com/advisories/GHSA-jchw-25xp-jwwc
> 
> </details>

`npm-express < 4.19.2` CODE_REPOSITORY/examples <ins>CVE-2024-29041</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/64

> <details><summary>Related URLs</summary>
> 
> - https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc
> - https://github.com/koajs/koa/issues/1800
> - https://github.com/expressjs/express/pull/5539
> - https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd
> - https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94
> - https://expressjs.com/en/4x/api.html#res.location
> - https://nvd.nist.gov/vuln/detail/CVE-2024-29041
> - https://github.com/advisories/GHSA-rv95-896h-c2vc
> 
> </details>

`npm-postcss < 8.5.10` CODE_REPOSITORY/examples <ins>CVE-2026-41305</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/764

> <details><summary>Related URLs</summary>
> 
> - https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93
> - https://nvd.nist.gov/vuln/detail/CVE-2026-41305
> - https://github.com/postcss/postcss/releases/tag/8.5.10
> - https://github.com/advisories/GHSA-qx2v-qp2m-jg93
> 
> </details>

`npm-hono >= 4.0.0, < 4.12.27` CODE_REPOSITORY/examples <ins>CVE-2026-59895</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/919

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-w62v-xxxg-mg59
> - https://nvd.nist.gov/vuln/detail/CVE-2026-59895
> - https://github.com/honojs/hono/commit/cd3f6f7194f0e5c9d4b26ae0cf232018d0f388fc
> - https://github.com/honojs/hono/releases/tag/v4.12.27
> - https://github.com/advisories/GHSA-w62v-xxxg-mg59
> 
> </details>



Navigation Menu

Uh oh!

[VANTA] [VULNERABILITY] <HIGH> CVE-2023-26159, CVE-2023-45857, CVE-2024-28849 and others, fix before 2026-10-03 #39

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

[VANTA] [VULNERABILITY] <HIGH> CVE-2023-26159, CVE-2023-45857, CVE-2024-28849 and others, fix before 2026-10-03 #39

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions