# Security Audit Report — @kimtaeyoon83/mcp-server-youtube-transcript - **Report ID:** `39aebc92-c01d-43fc-ba19-445ef6e1676a` - **Generated:** 2026-07-21T21:25:13.001084+00:00 - **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4) ## 1. Executive Summary **Badge:** Unsafe (composite) **Security score:** 45.71 | Scanner | Badge | | --- | --- | | agent-audit-kit | Caution | | agentshield | Verified | | bearer | Verified | | cisco-skill-scanner | Verified | | nerlo-behavioral | Verified | | nerlo-install-instruction | Verified | | osv-scanner | Unsafe | | trivy | Unsafe | | Severity | Findings | | --- | --- | | critical | 0 | | high | 34 | | medium | 75 | | low | 18 | @kimtaeyoon83/mcp-server-youtube-transcript is NOT recommended for integration: the scan surfaced 0 critical and 34 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering. ## 2. Source Provenance - **Repository:** https://github.com/kimtaeyoon83/mcp-server-youtube-transcript - **Commit scanned:** `unknown` - **License:** MIT - **Maintainer:** Freddie - **Version:** 0.1.1 ## 3. Per-Scanner Detail ### agentshield (v1.4.0) — Verified / 100.0 No findings. ### cisco-skill-scanner (v2.0.11) — Verified / 87.5 - **[medium] Moderate analyzability score** — Only 70% of skill content could be analyzed. 3 of 11 files are opaque to the scanner. Some content could not be verified as safe. (/repo:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None) - **[medium] Outbound network request primitives in JavaScript/TypeScript** — Pattern detected: https.request( (/repo/src/youtube-fetcher.ts:98) ### agent-audit-kit (v0.3.26) — Caution / 61.0 - **[low] Dependency count exceeds threshold** — More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision. (package-lock.json:None) - **[low] MCP server repo missing SECURITY.md or security_contact** — A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a 'security_contact' entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel. (SECURITY.md:None) - **[medium] Repo depends on a third-party agent-platform SDK** — The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel × Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants. (package.json:25) - **[high] MCP server built on the upstream SDK without STDIO sanitizer** — Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python 'mcp' / 'modelcontextprotocol', TS '@modelcontextprotocol/sdk', Java 'io.modelcontextprotocol:*', Rust 'mcp' / 'modelcontextprotocol') and exposes a STDIO transport ('StdioServerTransport', 'stdio_server', etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed — sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L (src/index.ts:None) - **[high] Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)** — A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python 'mcp' >= 1.23.0, TS '@modelcontextprotocol/sdk' >= 1.21.1, Java 'io.modelcontextprotocol.sdk:mcp-core' >= 0.11.0, '@apollo/mcp-server' >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug. (package.json:None) ### bearer (v2.0.2) — Verified / 100.0 No findings. ### nerlo-behavioral (v0.1.0) — Verified / 100.0 No findings. ### nerlo-install-instruction (v0.1.0) — Verified / 100.0 No findings. ### trivy (v0.71.0) — Unsafe / 0.0 - **[low] @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue** — A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. (package-lock.json:None) - **[high] @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware** — @hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middl (package-lock.json:None) - **[medium] @hono/node-server: Middleware bypass via repeated slashes in serveStatic** — @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13. (package-lock.json:None) - **[high] Anthropic's MCP TypeScript SDK has a ReDoS vulnerability** — Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node. (package-lock.json:None) - **[high] @modelcontextprotocol/sdk: @modelcontextprotocol/sdk cross-client data leak** — MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0. (package-lock.json:None) - **[low] Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files** — A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk (package-lock.json:None) - **[medium] ajv: ReDoS via $data reference** — ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a\|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds (package-lock.json:None) - **[low] body-parser: body-parser: Denial of Service via invalid limit option** — Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars (package-lock.json:None) - **[high] fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies** — fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Version (package-lock.json:None) - **[high] fast-uri: fast-uri: URI authority bypass due to improper delimiter handling** — fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a differ (package-lock.json:None) - **[high] form-data: form-data: Form field override via CRLF injection** — form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the 'field' argument to 'FormData\#append' and the 'filename' option are concatenated verbatim into the 'Content-Disposition' header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta (package-lock.json:None) - **[high] Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly speci (package-lock.json:None) - **[high] Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an expl (package-lock.json:None) - **[high] Hono vulnerable to arbitrary file access via serveStatic vulnerability ** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving (package-lock.json:None) - **[high] hono: CORS Middleware reflects any Origin with credentials when 'origin' defaults to the wildcard** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25. (package-lock.json:None) - **[medium] Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The 'IPV4_REGEX' pattern and 'convertIPv4ToBinary' function in 'src/utils/ipaddr.ts' do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls. Version 4.11.7 contains a patch for the issue. (package-lock.json:None) - **[medium] Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as 'Cache-Control: private' or 'Cache-Control: no-store', which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has (package-lock.json:None) - **[medium] Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys. Version 4.11.7 contains a patch for the issue. (package-lock.json:None) - **[medium] Hono vulnerable to XSS through ErrorBoundary component ** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exists in the 'ErrorBoundary' component of the hono/jsx library. Under certain usage patterns, untrusted user-controlled strings may be rendered as raw HTML, allowing arbitrary script execution in the victim's browser. Version 4.11.7 patches the issue. (package-lock.json:None) - **[medium] Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\r) or newline (\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4. (package-lock.json:None) - **[medium] Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4. (package-lock.json:None) - **[medium] Hono: Middleware bypass via repeated slashes in serveStatic** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in (package-lock.json:None) - **[medium] Hono: Path traversal in toSSG() allows writing files outside the output directory** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12. (package-lock.json:None) - **[medium] Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12. (package-lock.json:None) - **[medium] Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12. (package-lock.json:None) - **[medium] hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4 (package-lock.json:None) - **[medium] Hono: bodyLimit() can be bypassed for chunked / unknown-length requests** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16. (package-lock.json:None) - **[medium] Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18. (package-lock.json:None) - **[medium] Hono has CSS Declaration Injection via Style Object Values in JSX SSR** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18. (package-lock.json:None) - **[medium] Hono: JWT middleware accepts any Authorization scheme, not only Bearer** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regardless of the scheme name in the first position — proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is (package-lock.json:None) - **[medium] Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 ** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the (package-lock.json:None) - **[medium] Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \r, \n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed (package-lock.json:None) - **[medium] Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed (package-lock.json:None) - **[medium] hono: Path traversal in 'serve-static' on Windows via encoded backslash ('%5C')** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25. (package-lock.json:None) - **[medium] hono: AWS Lambda adapter merges multiple 'Set-Cookie' headers into one value, dropping cookies on ALB single-header and Lattice** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25. (package-lock.json:None) - **[medium] hono: Body Limit Middleware can be bypassed on AWS Lambda by understating 'Content-Length'** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a (package-lock.json:None) - **[medium] hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid (package-lock.json:None) - **[medium] hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR** — hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements. (package-lock.json:None) - **[medium] Hono missing validation of cookie name on write path in setCookie()** — \#\# Summary Cookie names are not validated on the write path when using 'setCookie()', 'serialize()', or 'serializeSigned()' to generate Set-Cookie headers. While certain cookie attributes such as domain and path are validated, the cookie name itself may contain invalid characters. This results in inconsistent handling of cookie names between parsing (read path) and serialization (write path). \#\# Details When applications use 'setCookie()', 'serialize()', or 'serializeSigned()' with a user-c (package-lock.json:None) - **[medium] Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })** — \#\# Summary When using 'parseBody({ dot: true })' in HonoRequest, specially crafted form field names such as '__proto__.x' could create objects containing a '__proto__' property. If the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object. \#\# Details The 'parseBody({ dot: true })' feature supports dot notation to construct nested objects from form field names. In previous versions, the '__proto__' (package-lock.json:None) - **[low] Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()** — Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() — typically when the application itself issues such tokens, or when the signing key is otherwise unde (package-lock.json:None) - **[low] Hono added timing comparison hardening in basicAuth and bearerAuth** — \#\# Summary The 'basicAuth' and 'bearerAuth' middlewares previously used a comparison that was not fully timing-safe. The 'timingSafeEqual' function used normal string equality ('===') when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing differences. The implementation has been updated to use a safer comparison method. \#\# Details The issue was caused by the use of normal string equality ('===') when comparing hash values ins (package-lock.json:None) - **[medium] jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin** — Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website. (package-lock.json:None) - **[high] path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions** — Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as '{a}{b}{c}:z'. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns. (package-lock.json:None) - **[medium] path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards** — Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a too (package-lock.json:None) - **[medium] qs: qs: Denial of Service via improper input validation in array parsing** — Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations. Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la (package-lock.json:None) - **[medium] \#\#\# Summary 'qs.stringify' throws 'TypeError' when called with 'arr ...** — \#\#\# Summary 'qs.stringify' throws 'TypeError' when called with 'arrayFormat: 'comma'' and 'encodeValuesOnly: true' on an array containing 'null' or 'undefined'. The throw is synchronous and not handled by any of qs's null-related options ('skipNulls', 'strictNullHandling'). \#\#\# Details In the comma + 'encodeValuesOnly' branch, 'lib/stringify.js:145' mapped the array through the raw encoder before joining: '''js obj = utils.maybeMap(obj, encoder); ''' 'utils.encode' ('lib/uti (package-lock.json:None) - **[low] qs: qs's arrayLimit bypass in comma parsing allows denial of service** — \#\#\# Summary The 'arrayLimit' option in qs does not enforce limits for comma-separated values when 'comma: true' is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284). \#\#\# Details When the 'comma' option is set to 'true' (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., '? (package-lock.json:None) - **[high] undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames** — Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (package-lock.json:None) - **[high] undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression** — The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to e (package-lock.json:None) - **[high] undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter** — ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to cre (package-lock.json:None) - **[medium] undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers** — Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted: * Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays * Applications that accept user-controlled header names without case-normalization Potential conseque (package-lock.json:None) - **[medium] undici: Undici: HTTP header injection and request smuggling vulnerability** — ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { heade (package-lock.json:None) - **[medium] undici: Undici: Denial of Service via excessive decompression steps** — Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0. (package-lock.json:None) - **[medium] undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding** — Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either. Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inj (package-lock.json:None) - **[low] undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header** — Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie header (package-lock.json:None) - **[low] undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.** — Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-ali (package-lock.json:None) ### osv-scanner (v2.3.8) — Unsafe / 0.0 - **[medium] GHSA-866g-f22w-33x8 — npm @ai-sdk/provider-utils@2.2.8** — aliases: CVE-2026-8769, GHSA-866g-f22w-33x8 \| CVSS: 4.3 (/repo/package-lock.json:None) - **[medium] GHSA-92pp-h63x-v22m — npm @hono/node-server@1.19.7** — aliases: CVE-2026-39406, GHSA-92pp-h63x-v22m \| CVSS: 5.3 (/repo/package-lock.json:None) - **[high] GHSA-wc8c-qw6v-h7f6 — npm @hono/node-server@1.19.7** — aliases: CVE-2026-29087, GHSA-wc8c-qw6v-h7f6 \| CVSS: 7.5 (/repo/package-lock.json:None) - **[high] GHSA-345p-7cg4-v4c7 — npm @modelcontextprotocol/sdk@1.25.1** — aliases: CVE-2026-25536, GHSA-345p-7cg4-v4c7 \| CVSS: 7.1 (/repo/package-lock.json:None) - **[high] GHSA-8r9q-7v3j-jr4g — npm @modelcontextprotocol/sdk@1.25.1** — aliases: CVE-2026-0621, GHSA-8r9q-7v3j-jr4g \| CVSS: 8.7 (/repo/package-lock.json:None) - **[low] GHSA-rwvc-j5jr-mgvh — npm ai@4.3.19** — aliases: CVE-2025-48985, GHSA-rwvc-j5jr-mgvh \| CVSS: 3.7 (/repo/package-lock.json:None) - **[medium] GHSA-2g4f-4pwh-qvx6 — npm ajv@8.17.1** — aliases: CVE-2025-69873, GHSA-2g4f-4pwh-qvx6 \| CVSS: 5.5 (/repo/package-lock.json:None) - **[low] GHSA-v422-hmwv-36x6 — npm body-parser@2.2.1** — aliases: CVE-2026-12590, GHSA-v422-hmwv-36x6 \| CVSS: 3.7 (/repo/package-lock.json:None) - **[high] GHSA-3jxr-9vmj-r5cp — npm brace-expansion@1.1.12** — aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp \| CVSS: 7.7 (/repo/package-lock.json:None) - **[medium] GHSA-f886-m6hf-6m8v — npm brace-expansion@1.1.12** — aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v \| CVSS: 6.5 (/repo/package-lock.json:None) - **[high] GHSA-q3j6-qgpj-74h6 — npm fast-uri@3.1.0** — aliases: CVE-2026-6321, GHSA-q3j6-qgpj-74h6 \| CVSS: 7.5 (/repo/package-lock.json:None) - **[high] GHSA-v39h-62p7-jpjc — npm fast-uri@3.1.0** — aliases: CVE-2026-6322, GHSA-v39h-62p7-jpjc \| CVSS: 7.5 (/repo/package-lock.json:None) - **[high] GHSA-hmw2-7cc7-3qxx — npm form-data@4.0.5** — aliases: CVE-2026-12143, GHSA-hmw2-7cc7-3qxx \| CVSS: 8.7 (/repo/package-lock.json:None) - **[medium] GHSA-26pp-8wgv-hjvm — npm hono@4.11.1** — aliases: CVE-2026-56762, GHSA-26pp-8wgv-hjvm \| CVSS: 5.3 (/repo/package-lock.json:None) - **[medium] GHSA-2gcr-mfcq-wcc3 — npm hono@4.11.1** — aliases: CVE-2026-47676, GHSA-2gcr-mfcq-wcc3 \| CVSS: 5.3 (/repo/package-lock.json:None) - **[medium] GHSA-3hrh-pfw6-9m5x — npm hono@4.11.1** — aliases: CVE-2026-47675, GHSA-3hrh-pfw6-9m5x \| CVSS: 4.3 (/repo/package-lock.json:None) - **[high] GHSA-3vhc-576x-3qv4 — npm hono@4.11.1** — aliases: CVE-2026-22818, GHSA-3vhc-576x-3qv4 \| CVSS: 8.2 (/repo/package-lock.json:None) - **[medium] GHSA-458j-xx4x-4375 — npm hono@4.11.1** — aliases: CVE-2026-56761, GHSA-458j-xx4x-4375 \| CVSS: 4.3 (/repo/package-lock.json:None) - **[medium] GHSA-5pq2-9x2x-5p6w — npm hono@4.11.1** — aliases: CVE-2026-29086, GHSA-5pq2-9x2x-5p6w \| CVSS: 5.4 (/repo/package-lock.json:None) - **[medium] GHSA-69xw-7hcm-h432 — npm hono@4.11.1** — aliases: CVE-2026-44455, GHSA-69xw-7hcm-h432 \| CVSS: 4.7 (/repo/package-lock.json:None) - **[medium] GHSA-6wqw-2p9w-4vw4 — npm hono@4.11.1** — aliases: CVE-2026-24472, GHSA-6wqw-2p9w-4vw4 \| CVSS: 5.3 (/repo/package-lock.json:None) - **[high] GHSA-88fw-hqm2-52qc — npm hono@4.11.1** — aliases: CVE-2026-54290, GHSA-88fw-hqm2-52qc \| CVSS: 7.1 (/repo/package-lock.json:None) - **[medium] GHSA-9r54-q6cx-xmh5 — npm hono@4.11.1** — aliases: CVE-2026-24771, GHSA-9r54-q6cx-xmh5 \| CVSS: 4.7 (/repo/package-lock.json:None) - **[medium] GHSA-9vqf-7f2p-gf9v — npm hono@4.11.1** — aliases: CVE-2026-44456, GHSA-9vqf-7f2p-gf9v \| CVSS: 6.5 (/repo/package-lock.json:None) - **[medium] GHSA-f577-qrjj-4474 — npm hono@4.11.1** — aliases: CVE-2026-47673, GHSA-f577-qrjj-4474 \| CVSS: 4.8 (/repo/package-lock.json:None) - **[high] GHSA-f67f-6cw9-8mq4 — npm hono@4.11.1** — aliases: CVE-2026-22817, GHSA-f67f-6cw9-8mq4 \| CVSS: 8.2 (/repo/package-lock.json:None) - **[low] GHSA-gq3j-xvxp-8hrf — npm hono@4.11.1** — aliases: CVE-2026-56764, GHSA-gq3j-xvxp-8hrf \| CVSS: 3.7 (/repo/package-lock.json:None) - **[low] GHSA-hm8q-7f3q-5f36 — npm hono@4.11.1** — aliases: CVE-2026-44459, GHSA-hm8q-7f3q-5f36 \| CVSS: 3.8 (/repo/package-lock.json:None) - **[medium] GHSA-j6c9-x7qj-28xf — npm hono@4.11.1** — aliases: CVE-2026-54287, GHSA-j6c9-x7qj-28xf \| CVSS: 5.3 (/repo/package-lock.json:None) - **[medium] GHSA-p6xx-57qc-3wxr — npm hono@4.11.1** — aliases: CVE-2026-29085, GHSA-p6xx-57qc-3wxr \| CVSS: 6.5 (/repo/package-lock.json:None) - **[medium] GHSA-p77w-8qqv-26rm — npm hono@4.11.1** — aliases: CVE-2026-44457, GHSA-p77w-8qqv-26rm \| CVSS: 5.3 (/repo/package-lock.json:None) - **[high] GHSA-q5qw-h33p-qvwr — npm hono@4.11.1** — aliases: CVE-2026-29045, GHSA-q5qw-h33p-qvwr \| CVSS: 7.5 (/repo/package-lock.json:None) - **[medium] GHSA-qp7p-654g-cw7p — npm hono@4.11.1** — aliases: CVE-2026-44458, GHSA-qp7p-654g-cw7p \| CVSS: 4.3 (/repo/package-lock.json:None) - **[medium] GHSA-r354-f388-2fhh — npm hono@4.11.1** — aliases: CVE-2026-24398, GHSA-r354-f388-2fhh \| CVSS: 4.8 (/repo/package-lock.json:None) - **[medium] GHSA-r5rp-j6wh-rvv4 — npm hono@4.11.1** — aliases: CVE-2026-39410, GHSA-r5rp-j6wh-rvv4 \| CVSS: 4.8 (/repo/package-lock.json:None) - **[medium] GHSA-rv63-4mwf-qqc2 — npm hono@4.11.1** — aliases: CVE-2026-54288, GHSA-rv63-4mwf-qqc2 \| CVSS: 6.5 (/repo/package-lock.json:None) - **[medium] GHSA-v8w9-8mx6-g223 — npm hono@4.11.1** — aliases: CVE-2026-56763, GHSA-v8w9-8mx6-g223 \| CVSS: 4.8 (/repo/package-lock.json:None) - **[medium] GHSA-w332-q679-j88p — npm hono@4.11.1** — aliases: CVE-2026-24473, GHSA-w332-q679-j88p \| CVSS: 6.3 (/repo/package-lock.json:None) - **[medium] GHSA-wgpf-jwqj-8h8p — npm hono@4.11.1** — aliases: CVE-2026-54289, GHSA-wgpf-jwqj-8h8p \| CVSS: 4.8 (/repo/package-lock.json:None) - **[medium] GHSA-wmmm-f939-6g9c — npm hono@4.11.1** — aliases: CVE-2026-39407, GHSA-wmmm-f939-6g9c \| CVSS: 5.3 (/repo/package-lock.json:None) - **[medium] GHSA-wwfh-h76j-fc44 — npm hono@4.11.1** — aliases: CVE-2026-54286, GHSA-wwfh-h76j-fc44 \| CVSS: 5.9 (/repo/package-lock.json:None) - **[medium] GHSA-xf4j-xp2r-rqqx — npm hono@4.11.1** — aliases: CVE-2026-39408, GHSA-xf4j-xp2r-rqqx \| CVSS: 5.9 (/repo/package-lock.json:None) - **[medium] GHSA-xpcf-pg52-r92g — npm hono@4.11.1** — aliases: CVE-2026-39409, GHSA-xpcf-pg52-r92g \| CVSS: 6.3 (/repo/package-lock.json:None) - **[medium] GHSA-xrhx-7g5j-rcj5 — npm hono@4.11.1** — aliases: CVE-2026-47674, GHSA-xrhx-7g5j-rcj5 \| CVSS: 5.3 (/repo/package-lock.json:None) - **[medium] GHSA-33vc-wfww-vjfv — npm jsondiffpatch@0.6.0** — aliases: CVE-2025-9910, GHSA-33vc-wfww-vjfv \| CVSS: 5.3 (/repo/package-lock.json:None) - **[high] GHSA-23c5-xmqv-rm74 — npm minimatch@3.1.2** — aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 \| CVSS: 7.5 (/repo/package-lock.json:None) - **[high] GHSA-3ppc-4f35-3m26 — npm minimatch@3.1.2** — aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 \| CVSS: 8.7 (/repo/package-lock.json:None) - **[high] GHSA-7r86-cg39-jmmj — npm minimatch@3.1.2** — aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj \| CVSS: 7.5 (/repo/package-lock.json:None) - **[medium] GHSA-27v5-c462-wpq7 — npm path-to-regexp@8.3.0** — aliases: CVE-2026-4923, GHSA-27v5-c462-wpq7 \| CVSS: 5.9 (/repo/package-lock.json:None) - **[high] GHSA-j3q9-mxjg-w52f — npm path-to-regexp@8.3.0** — aliases: CVE-2026-4926, GHSA-j3q9-mxjg-w52f \| CVSS: 7.5 (/repo/package-lock.json:None) - **[medium] GHSA-6rw7-vpxm-498p — npm qs@6.14.0** — aliases: CVE-2025-15284, GHSA-6rw7-vpxm-498p \| CVSS: 6.3 (/repo/package-lock.json:None) - **[medium] GHSA-q8mj-m7cp-5q26 — npm qs@6.14.0** — aliases: CVE-2026-8723, GHSA-q8mj-m7cp-5q26 \| CVSS: 6.3 (/repo/package-lock.json:None) - **[low] GHSA-w7fw-mjwx-w883 — npm qs@6.14.0** — aliases: CVE-2026-2391, GHSA-w7fw-mjwx-w883 \| CVSS: 3.7 (/repo/package-lock.json:None) - **[medium] GHSA-2mjp-6q6p-2qxm — npm undici@5.29.0** — aliases: CVE-2026-1525, GHSA-2mjp-6q6p-2qxm \| CVSS: 6.5 (/repo/package-lock.json:None) - **[low] GHSA-35p6-xmwp-9g52 — npm undici@5.29.0** — aliases: CVE-2026-6733, GHSA-35p6-xmwp-9g52 \| CVSS: 3.7 (/repo/package-lock.json:None) - **[medium] GHSA-4992-7rv2-5pvq — npm undici@5.29.0** — aliases: CVE-2026-1527, GHSA-4992-7rv2-5pvq \| CVSS: 4.6 (/repo/package-lock.json:None) - **[low] GHSA-g8m3-5g58-fq7m — npm undici@5.29.0** — aliases: CVE-2026-11525, GHSA-g8m3-5g58-fq7m \| CVSS: 3.7 (/repo/package-lock.json:None) - **[medium] GHSA-g9mf-h72j-4rw9 — npm undici@5.29.0** — aliases: CVE-2026-22036, GHSA-g9mf-h72j-4rw9 \| CVSS: 5.9 (/repo/package-lock.json:None) - **[medium] GHSA-p88m-4jfj-68fv — npm undici@5.29.0** — aliases: CVE-2026-9679, GHSA-p88m-4jfj-68fv \| CVSS: 5.9 (/repo/package-lock.json:None) - **[high] GHSA-v9p9-hfj2-hcw8 — npm undici@5.29.0** — aliases: CVE-2026-2229, GHSA-v9p9-hfj2-hcw8 \| CVSS: 7.5 (/repo/package-lock.json:None) - **[high] GHSA-vrm6-8vpv-qv8q — npm undici@5.29.0** — aliases: CVE-2026-1526, GHSA-vrm6-8vpv-qv8q \| CVSS: 7.5 (/repo/package-lock.json:None) - **[high] GHSA-vxpw-j846-p89q — npm undici@5.29.0** — aliases: CVE-2026-12151, GHSA-vxpw-j846-p89q \| CVSS: 7.5 (/repo/package-lock.json:None) ## 4. Threat Model Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report. ## 5. Audit Chain - **Scan job:** `122c060e-ae42-4e67-a1fa-ba71b126cd1b` - **Completed:** 2026-07-21T02:18:44.386680+00:00 - **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:5474b7145f1ee0b69e7478af61657121171da0efe37e13416e4783bb0897c0be` - **AI decision log entries:** 1 - `f1ee06ee-eb89-48ea-b95c-7f37516107a9` ## 6. Appendix — Raw Scanner Output ```json [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 7.34707873800653, "status": "complete", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "supply_chain" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 87.5, "scanner_badge": "Verified", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "policy_violation", "file_path": "/repo", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Moderate analyzability score", "description": "Only 70% of skill content could be analyzed. 3 of 11 files are opaque to the scanner. Some content could not be verified as safe.", "remediation": "Review opaque files and replace with inspectable formats where possible." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/src/youtube-fetcher.ts", "line_number": 98, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: https.request(", "remediation": "Ensure network operations are necessary and document allowed destinations" } ], "execution_duration_seconds": 30.85040794700035, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 1, "high": 0, "medium": 2, "critical": 0, "informational": 1 } }, "display_score": 87.5, "display_badge": "Verified" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 61.0, "scanner_badge": "Caution", "findings": [ { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "AAK-SUPPLY-005", "title": "Dependency count exceeds threshold", "description": "More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision.", "remediation": "Audit and remove unused dependencies. Consider lighter alternatives." }, { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "SECURITY.md", "line_number": null, "rule_identifier": "AAK-SEC-MD-001", "title": "MCP server repo missing SECURITY.md or security_contact", "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.", "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "package.json", "line_number": 25, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "src/index.ts", "line_number": null, "rule_identifier": "AAK-ANTHROPIC-SDK-001", "title": "MCP server built on the upstream SDK without STDIO sanitizer", "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L", "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "package.json", "line_number": null, "rule_identifier": "AAK-DNS-REBIND-002", "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)", "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.", "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)." } ], "execution_duration_seconds": 12.534826382994652, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 10, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 2, "high": 2, "medium": 1, "critical": 0, "informational": 0 } }, "display_score": 61.0, "display_badge": "Caution" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 14.180081578000681, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 46.139828141996986, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 3, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 45.20730747700145, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 1, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-8769", "title": "@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue", "description": "A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.", "remediation": null }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-29087", "title": "@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware", "description": "@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middl", "remediation": "Upgrade @hono/node-server from 1.19.7 to 1.19.10 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-39406", "title": "@hono/node-server: Middleware bypass via repeated slashes in serveStatic", "description": "@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.", "remediation": "Upgrade @hono/node-server from 1.19.7 to 1.19.13 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-0621", "title": "Anthropic's MCP TypeScript SDK has a ReDoS vulnerability", "description": "Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.", "remediation": "Upgrade @modelcontextprotocol/sdk from 1.25.1 to 1.25.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-25536", "title": "@modelcontextprotocol/sdk: @modelcontextprotocol/sdk cross-client data leak", "description": "MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.", "remediation": "Upgrade @modelcontextprotocol/sdk from 1.25.1 to 1.26.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2025-48985", "title": "Vercel\u2019s AI SDK's filetype whitelists can be bypassed when uploading files", "description": "A vulnerability in Vercel\u2019s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.\r\n\r\nMore details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk", "remediation": "Upgrade ai from 4.3.19 to 5.0.52, 5.1.0-beta.9 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2025-69873", "title": "ajv: ReDoS via $data reference", "description": "ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds", "remediation": "Upgrade ajv from 8.17.1 to 8.18.0, 6.14.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12590", "title": "body-parser: body-parser: Denial of Service via invalid limit option", "description": "Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars", "remediation": "Upgrade body-parser from 2.2.1 to 1.20.6, 2.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-6321", "title": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies", "description": "fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Version", "remediation": "Upgrade fast-uri from 3.1.0 to 3.1.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-6322", "title": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling", "description": "fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a differ", "remediation": "Upgrade fast-uri from 3.1.0 to 3.1.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12143", "title": "form-data: form-data: Form field override via CRLF injection", "description": "form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta", "remediation": "Upgrade form-data from 4.0.5 to 2.5.6, 3.0.5, 4.0.6 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-22817", "title": "Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono\u2019s JWK/JWKS JWT verification middleware allowed the JWT header\u2019s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly speci", "remediation": "Upgrade hono from 4.11.1 to 4.11.4 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-22818", "title": "Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks \"alg\" (untrusted header.alg fallback)", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono\u2019s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an expl", "remediation": "Upgrade hono from 4.11.1 to 4.11.4 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-29045", "title": "Hono vulnerable to arbitrary file access via serveStatic vulnerability ", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving", "remediation": "Upgrade hono from 4.11.1 to 4.12.4 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54290", "title": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.11.1 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-24398", "title": "Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The `IPV4_REGEX` pattern and `convertIPv4ToBinary` function in `src/utils/ipaddr.ts` do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls. Version 4.11.7 contains a patch for the issue.", "remediation": "Upgrade hono from 4.11.1 to 4.11.7 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-24472", "title": "Hono cache middleware ignores \"Cache-Control: private\" leading to Web Cache Deception", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as `Cache-Control: private` or `Cache-Control: no-store`, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has ", "remediation": "Upgrade hono from 4.11.1 to 4.11.7 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-24473", "title": "Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys. Version 4.11.7 contains a patch for the issue.", "remediation": "Upgrade hono from 4.11.1 to 4.11.7 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-24771", "title": "Hono vulnerable to XSS through ErrorBoundary component ", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exists in the `ErrorBoundary` component of the hono/jsx library. Under certain usage patterns, untrusted user-controlled strings may be rendered as raw HTML, allowing arbitrary script execution in the victim's browser. Version 4.11.7 patches the issue.", "remediation": "Upgrade hono from 4.11.1 to 4.11.7 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-29085", "title": "Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\\r) or newline (\\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.", "remediation": "Upgrade hono from 4.11.1 to 4.12.4 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-29086", "title": "Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\\r), or newline characters (\\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.", "remediation": "Upgrade hono from 4.11.1 to 4.12.4 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-39407", "title": "Hono: Middleware bypass via repeated slashes in serveStatic", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in ", "remediation": "Upgrade hono from 4.11.1 to 4.12.12 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-39408", "title": "Hono: Path traversal in toSSG() allows writing files outside the output directory", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.", "remediation": "Upgrade hono from 4.11.1 to 4.12.12 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-39409", "title": "Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.", "remediation": "Upgrade hono from 4.11.1 to 4.12.12 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-39410", "title": "Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.", "remediation": "Upgrade hono from 4.11.1 to 4.12.12 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44455", "title": "hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4", "remediation": "Upgrade hono from 4.11.1 to 4.12.16 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44456", "title": "Hono: bodyLimit() can be bypassed for chunked / unknown-length requests", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.", "remediation": "Upgrade hono from 4.11.1 to 4.12.16 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44457", "title": "Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.", "remediation": "Upgrade hono from 4.11.1 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44458", "title": "Hono has CSS Declaration Injection via Style Object Values in JSX SSR", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.", "remediation": "Upgrade hono from 4.11.1 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47673", "title": "Hono: JWT middleware accepts any Authorization scheme, not only Bearer", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value \u2014 regardless of the scheme name in the first position \u2014 proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is", "remediation": "Upgrade hono from 4.11.1 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47674", "title": "Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 ", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule \u2014 such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses \u2014 do not match the normalized rule entry, causing the ", "remediation": "Upgrade hono from 4.11.1 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47675", "title": "Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed ", "remediation": "Upgrade hono from 4.11.1 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-47676", "title": "Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed", "remediation": "Upgrade hono from 4.11.1 to 4.12.21 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54286", "title": "hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.11.1 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54287", "title": "hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.", "remediation": "Upgrade hono from 4.11.1 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54288", "title": "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a", "remediation": "Upgrade hono from 4.11.1 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-54289", "title": "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid", "remediation": "Upgrade hono from 4.11.1 to 4.12.25 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-56761", "title": "hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR", "description": "hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.", "remediation": "Upgrade hono from 4.11.1 to 4.12.14 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-26pp-8wgv-hjvm", "title": "Hono missing validation of cookie name on write path in setCookie()", "description": "## Summary\n\nCookie names are not validated on the write path when using `setCookie()`, `serialize()`, or `serializeSigned()` to generate Set-Cookie headers.\n\nWhile certain cookie attributes such as domain and path are validated, the cookie name itself may contain invalid characters.\n\nThis results in inconsistent handling of cookie names between parsing (read path) and serialization (write path).\n\n## Details\n\nWhen applications use `setCookie()`, `serialize()`, or `serializeSigned()` with a user-c", "remediation": "Upgrade hono from 4.11.1 to 4.12.12 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-v8w9-8mx6-g223", "title": "Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })", "description": "## Summary\n\nWhen using `parseBody({ dot: true })` in HonoRequest, specially crafted form field names such as `__proto__.x` could create objects containing a `__proto__` property.\n\nIf the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object.\n\n## Details\n\nThe `parseBody({ dot: true })` feature supports dot notation to construct nested objects from form field names.\n\nIn previous versions, the `__proto__`", "remediation": "Upgrade hono from 4.11.1 to 4.12.7 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-44459", "title": "Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()", "description": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() \u2014 typically when the application itself issues such tokens, or when the signing key is otherwise unde", "remediation": "Upgrade hono from 4.11.1 to 4.12.18 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "GHSA-gq3j-xvxp-8hrf", "title": "Hono added timing comparison hardening in basicAuth and bearerAuth", "description": "## Summary\n\nThe `basicAuth` and `bearerAuth` middlewares previously used a comparison that was not fully timing-safe.\n\nThe `timingSafeEqual` function used normal string equality (`===`) when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing differences.\n\nThe implementation has been updated to use a safer comparison method.\n\n\n## Details\n\nThe issue was caused by the use of normal string equality (`===`) when comparing hash values ins", "remediation": "Upgrade hono from 4.11.1 to 4.11.10 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2025-9910", "title": "jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin", "description": "Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.", "remediation": "Upgrade jsondiffpatch from 0.6.0 to 0.7.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-4926", "title": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions", "description": "Impact:\n\nA bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.\n\nPatches:\n\nFixed in version 8.4.0.\n\nWorkarounds:\n\nLimit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.", "remediation": "Upgrade path-to-regexp from 8.3.0 to 8.4.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-4923", "title": "path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards", "description": "Impact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a too", "remediation": "Upgrade path-to-regexp from 8.3.0 to 8.4.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2025-15284", "title": "qs: qs: Denial of Service via improper input validation in array parsing", "description": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la", "remediation": "Upgrade qs from 6.14.0 to 6.14.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-8723", "title": "### Summary `qs.stringify` throws `TypeError` when called with `arr ...", "description": "### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti", "remediation": "Upgrade qs from 6.14.0 to 6.15.2 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-2391", "title": "qs: qs's arrayLimit bypass in comma parsing allows denial of service", "description": "### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?", "remediation": "Upgrade qs from 6.14.0 to 6.14.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12151", "title": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames", "description": "Impact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client", "remediation": "Upgrade undici from 5.29.0 to 6.27.0, 7.28.0, 8.5.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-1526", "title": "undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression", "description": "The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a \"decompression bomb\") that expands to an extremely large size in memory, causing the Node.js process to e", "remediation": "Upgrade undici from 5.29.0 to 6.24.0, 7.24.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-2229", "title": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter", "description": "ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the\u00a0server_max_window_bits\u00a0parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range\u00a0server_max_window_bits\u00a0value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to cre", "remediation": "Upgrade undici from 5.29.0 to 6.24.0, 7.24.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-1525", "title": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers", "description": "Undici allows duplicate HTTP\u00a0Content-Length\u00a0headers when they are provided in an array with case-variant names (e.g.,\u00a0Content-Length\u00a0and\u00a0content-length). This produces malformed HTTP/1.1 requests with multiple conflicting\u00a0Content-Length\u00a0values on the wire.\n\nWho is impacted:\n\n * Applications using\u00a0undici.request(),\u00a0undici.Client, or similar low-level APIs with headers passed as flat arrays\n * Applications that accept user-controlled header names without case-normalization\n\n\nPotential conseque", "remediation": "Upgrade undici from 5.29.0 to 6.24.0, 7.24.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-1527", "title": "undici: Undici: HTTP header injection and request smuggling vulnerability", "description": "ImpactWhen an application passes user-controlled input to the\u00a0upgrade\u00a0option of\u00a0client.request(), an attacker can inject CRLF sequences (\\r\\n) to:\n\n * Inject arbitrary HTTP headers\n * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)\nThe vulnerability exists because undici writes the\u00a0upgrade\u00a0value directly to the socket without validating for invalid header characters:\n\n// lib/dispatcher/client-h1.js:1121\nif (upgrade) {\n heade", "remediation": "Upgrade undici from 5.29.0 to 6.24.0, 7.24.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-22036", "title": "undici: Undici: Denial of Service via excessive decompression steps", "description": "Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.", "remediation": "Upgrade undici from 5.29.0 to 7.18.2, 6.23.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-9679", "title": "undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding", "description": "Impact:\nundici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 \u00a75.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inj", "remediation": "Upgrade undici from 5.29.0 to 6.27.0, 7.28.0, 8.5.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-11525", "title": "undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header", "description": "Impact:\nWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).\n\nAffected applications are those that consume Set-Cookie header", "remediation": "Upgrade undici from 5.29.0 to 6.27.0, 7.28.0, 8.5.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-6733", "title": "undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.", "description": "Impact:\nUndici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-ali", "remediation": "Upgrade undici from 5.29.0 to 6.27.0, 7.28.0, 8.5.0 or later" } ], "execution_duration_seconds": 1.390266693997546, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 8, "high": 14, "medium": 35, "critical": 0, "informational": 0 }, "manifests_scanned": [ "package-lock.json" ] }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-866g-f22w-33x8", "title": "GHSA-866g-f22w-33x8 \u2014 npm @ai-sdk/provider-utils@2.2.8", "description": "aliases: CVE-2026-8769, GHSA-866g-f22w-33x8 | CVSS: 4.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-92pp-h63x-v22m", "title": "GHSA-92pp-h63x-v22m \u2014 npm @hono/node-server@1.19.7", "description": "aliases: CVE-2026-39406, GHSA-92pp-h63x-v22m | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-wc8c-qw6v-h7f6", "title": "GHSA-wc8c-qw6v-h7f6 \u2014 npm @hono/node-server@1.19.7", "description": "aliases: CVE-2026-29087, GHSA-wc8c-qw6v-h7f6 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-345p-7cg4-v4c7", "title": "GHSA-345p-7cg4-v4c7 \u2014 npm @modelcontextprotocol/sdk@1.25.1", "description": "aliases: CVE-2026-25536, GHSA-345p-7cg4-v4c7 | CVSS: 7.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-8r9q-7v3j-jr4g", "title": "GHSA-8r9q-7v3j-jr4g \u2014 npm @modelcontextprotocol/sdk@1.25.1", "description": "aliases: CVE-2026-0621, GHSA-8r9q-7v3j-jr4g | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-rwvc-j5jr-mgvh", "title": "GHSA-rwvc-j5jr-mgvh \u2014 npm ai@4.3.19", "description": "aliases: CVE-2025-48985, GHSA-rwvc-j5jr-mgvh | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-2g4f-4pwh-qvx6", "title": "GHSA-2g4f-4pwh-qvx6 \u2014 npm ajv@8.17.1", "description": "aliases: CVE-2025-69873, GHSA-2g4f-4pwh-qvx6 | CVSS: 5.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v422-hmwv-36x6", "title": "GHSA-v422-hmwv-36x6 \u2014 npm body-parser@2.2.1", "description": "aliases: CVE-2026-12590, GHSA-v422-hmwv-36x6 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@1.1.12", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-f886-m6hf-6m8v", "title": "GHSA-f886-m6hf-6m8v \u2014 npm brace-expansion@1.1.12", "description": "aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-q3j6-qgpj-74h6", "title": "GHSA-q3j6-qgpj-74h6 \u2014 npm fast-uri@3.1.0", "description": "aliases: CVE-2026-6321, GHSA-q3j6-qgpj-74h6 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v39h-62p7-jpjc", "title": "GHSA-v39h-62p7-jpjc \u2014 npm fast-uri@3.1.0", "description": "aliases: CVE-2026-6322, GHSA-v39h-62p7-jpjc | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-hmw2-7cc7-3qxx", "title": "GHSA-hmw2-7cc7-3qxx \u2014 npm form-data@4.0.5", "description": "aliases: CVE-2026-12143, GHSA-hmw2-7cc7-3qxx | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-26pp-8wgv-hjvm", "title": "GHSA-26pp-8wgv-hjvm \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-56762, GHSA-26pp-8wgv-hjvm | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-2gcr-mfcq-wcc3", "title": "GHSA-2gcr-mfcq-wcc3 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-47676, GHSA-2gcr-mfcq-wcc3 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3hrh-pfw6-9m5x", "title": "GHSA-3hrh-pfw6-9m5x \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-47675, GHSA-3hrh-pfw6-9m5x | CVSS: 4.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3vhc-576x-3qv4", "title": "GHSA-3vhc-576x-3qv4 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-22818, GHSA-3vhc-576x-3qv4 | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-458j-xx4x-4375", "title": "GHSA-458j-xx4x-4375 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-56761, GHSA-458j-xx4x-4375 | CVSS: 4.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-5pq2-9x2x-5p6w", "title": "GHSA-5pq2-9x2x-5p6w \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-29086, GHSA-5pq2-9x2x-5p6w | CVSS: 5.4", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-69xw-7hcm-h432", "title": "GHSA-69xw-7hcm-h432 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-44455, GHSA-69xw-7hcm-h432 | CVSS: 4.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-6wqw-2p9w-4vw4", "title": "GHSA-6wqw-2p9w-4vw4 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-24472, GHSA-6wqw-2p9w-4vw4 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-88fw-hqm2-52qc", "title": "GHSA-88fw-hqm2-52qc \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-54290, GHSA-88fw-hqm2-52qc | CVSS: 7.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-9r54-q6cx-xmh5", "title": "GHSA-9r54-q6cx-xmh5 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-24771, GHSA-9r54-q6cx-xmh5 | CVSS: 4.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-9vqf-7f2p-gf9v", "title": "GHSA-9vqf-7f2p-gf9v \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-44456, GHSA-9vqf-7f2p-gf9v | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-f577-qrjj-4474", "title": "GHSA-f577-qrjj-4474 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-47673, GHSA-f577-qrjj-4474 | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-f67f-6cw9-8mq4", "title": "GHSA-f67f-6cw9-8mq4 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-22817, GHSA-f67f-6cw9-8mq4 | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-gq3j-xvxp-8hrf", "title": "GHSA-gq3j-xvxp-8hrf \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-56764, GHSA-gq3j-xvxp-8hrf | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-hm8q-7f3q-5f36", "title": "GHSA-hm8q-7f3q-5f36 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-44459, GHSA-hm8q-7f3q-5f36 | CVSS: 3.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-j6c9-x7qj-28xf", "title": "GHSA-j6c9-x7qj-28xf \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-54287, GHSA-j6c9-x7qj-28xf | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-p6xx-57qc-3wxr", "title": "GHSA-p6xx-57qc-3wxr \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-29085, GHSA-p6xx-57qc-3wxr | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-p77w-8qqv-26rm", "title": "GHSA-p77w-8qqv-26rm \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-44457, GHSA-p77w-8qqv-26rm | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-q5qw-h33p-qvwr", "title": "GHSA-q5qw-h33p-qvwr \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-29045, GHSA-q5qw-h33p-qvwr | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-qp7p-654g-cw7p", "title": "GHSA-qp7p-654g-cw7p \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-44458, GHSA-qp7p-654g-cw7p | CVSS: 4.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-r354-f388-2fhh", "title": "GHSA-r354-f388-2fhh \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-24398, GHSA-r354-f388-2fhh | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-r5rp-j6wh-rvv4", "title": "GHSA-r5rp-j6wh-rvv4 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-39410, GHSA-r5rp-j6wh-rvv4 | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-rv63-4mwf-qqc2", "title": "GHSA-rv63-4mwf-qqc2 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-54288, GHSA-rv63-4mwf-qqc2 | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v8w9-8mx6-g223", "title": "GHSA-v8w9-8mx6-g223 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-56763, GHSA-v8w9-8mx6-g223 | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-w332-q679-j88p", "title": "GHSA-w332-q679-j88p \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-24473, GHSA-w332-q679-j88p | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-wgpf-jwqj-8h8p", "title": "GHSA-wgpf-jwqj-8h8p \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-54289, GHSA-wgpf-jwqj-8h8p | CVSS: 4.8", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-wmmm-f939-6g9c", "title": "GHSA-wmmm-f939-6g9c \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-39407, GHSA-wmmm-f939-6g9c | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-wwfh-h76j-fc44", "title": "GHSA-wwfh-h76j-fc44 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-54286, GHSA-wwfh-h76j-fc44 | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-xf4j-xp2r-rqqx", "title": "GHSA-xf4j-xp2r-rqqx \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-39408, GHSA-xf4j-xp2r-rqqx | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-xpcf-pg52-r92g", "title": "GHSA-xpcf-pg52-r92g \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-39409, GHSA-xpcf-pg52-r92g | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-xrhx-7g5j-rcj5", "title": "GHSA-xrhx-7g5j-rcj5 \u2014 npm hono@4.11.1", "description": "aliases: CVE-2026-47674, GHSA-xrhx-7g5j-rcj5 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-33vc-wfww-vjfv", "title": "GHSA-33vc-wfww-vjfv \u2014 npm jsondiffpatch@0.6.0", "description": "aliases: CVE-2025-9910, GHSA-33vc-wfww-vjfv | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-23c5-xmqv-rm74", "title": "GHSA-23c5-xmqv-rm74 \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3ppc-4f35-3m26", "title": "GHSA-3ppc-4f35-3m26 \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-7r86-cg39-jmmj", "title": "GHSA-7r86-cg39-jmmj \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-27v5-c462-wpq7", "title": "GHSA-27v5-c462-wpq7 \u2014 npm path-to-regexp@8.3.0", "description": "aliases: CVE-2026-4923, GHSA-27v5-c462-wpq7 | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-j3q9-mxjg-w52f", "title": "GHSA-j3q9-mxjg-w52f \u2014 npm path-to-regexp@8.3.0", "description": "aliases: CVE-2026-4926, GHSA-j3q9-mxjg-w52f | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-6rw7-vpxm-498p", "title": "GHSA-6rw7-vpxm-498p \u2014 npm qs@6.14.0", "description": "aliases: CVE-2025-15284, GHSA-6rw7-vpxm-498p | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-q8mj-m7cp-5q26", "title": "GHSA-q8mj-m7cp-5q26 \u2014 npm qs@6.14.0", "description": "aliases: CVE-2026-8723, GHSA-q8mj-m7cp-5q26 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-w7fw-mjwx-w883", "title": "GHSA-w7fw-mjwx-w883 \u2014 npm qs@6.14.0", "description": "aliases: CVE-2026-2391, GHSA-w7fw-mjwx-w883 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-2mjp-6q6p-2qxm", "title": "GHSA-2mjp-6q6p-2qxm \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-1525, GHSA-2mjp-6q6p-2qxm | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-35p6-xmwp-9g52", "title": "GHSA-35p6-xmwp-9g52 \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-6733, GHSA-35p6-xmwp-9g52 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-4992-7rv2-5pvq", "title": "GHSA-4992-7rv2-5pvq \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-1527, GHSA-4992-7rv2-5pvq | CVSS: 4.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-g8m3-5g58-fq7m", "title": "GHSA-g8m3-5g58-fq7m \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-11525, GHSA-g8m3-5g58-fq7m | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-g9mf-h72j-4rw9", "title": "GHSA-g9mf-h72j-4rw9 \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-22036, GHSA-g9mf-h72j-4rw9 | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-p88m-4jfj-68fv", "title": "GHSA-p88m-4jfj-68fv \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-9679, GHSA-p88m-4jfj-68fv | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v9p9-hfj2-hcw8", "title": "GHSA-v9p9-hfj2-hcw8 \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-2229, GHSA-v9p9-hfj2-hcw8 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-vrm6-8vpv-qv8q", "title": "GHSA-vrm6-8vpv-qv8q \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-1526, GHSA-vrm6-8vpv-qv8q | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-vxpw-j846-p89q", "title": "GHSA-vxpw-j846-p89q \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-12151, GHSA-vxpw-j846-p89q | CVSS: 7.5", "remediation": null } ], "execution_duration_seconds": 29.486539552002796, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "npm" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 7, "high": 18, "medium": 37, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/package-lock.json" ], "finding_id_aliases": { "GHSA-23c5-xmqv-rm74": [ "CVE-2026-27904" ], "GHSA-26pp-8wgv-hjvm": [ "CVE-2026-56762" ], "GHSA-27v5-c462-wpq7": [ "CVE-2026-4923" ], "GHSA-2g4f-4pwh-qvx6": [ "CVE-2025-69873" ], "GHSA-2gcr-mfcq-wcc3": [ "CVE-2026-47676" ], "GHSA-2mjp-6q6p-2qxm": [ "CVE-2026-1525" ], "GHSA-33vc-wfww-vjfv": [ "CVE-2025-9910" ], "GHSA-345p-7cg4-v4c7": [ "CVE-2026-25536" ], "GHSA-35p6-xmwp-9g52": [ "CVE-2026-6733" ], "GHSA-3hrh-pfw6-9m5x": [ "CVE-2026-47675" ], "GHSA-3jxr-9vmj-r5cp": [ "CVE-2026-13149" ], "GHSA-3ppc-4f35-3m26": [ "CVE-2026-26996" ], "GHSA-3vhc-576x-3qv4": [ "CVE-2026-22818" ], "GHSA-458j-xx4x-4375": [ "CVE-2026-56761" ], "GHSA-4992-7rv2-5pvq": [ "CVE-2026-1527" ], "GHSA-5pq2-9x2x-5p6w": [ "CVE-2026-29086" ], "GHSA-69xw-7hcm-h432": [ "CVE-2026-44455" ], "GHSA-6rw7-vpxm-498p": [ "CVE-2025-15284" ], "GHSA-6wqw-2p9w-4vw4": [ "CVE-2026-24472" ], "GHSA-7r86-cg39-jmmj": [ "CVE-2026-27903" ], "GHSA-866g-f22w-33x8": [ "CVE-2026-8769" ], "GHSA-88fw-hqm2-52qc": [ "CVE-2026-54290" ], "GHSA-8r9q-7v3j-jr4g": [ "CVE-2026-0621" ], "GHSA-92pp-h63x-v22m": [ "CVE-2026-39406" ], "GHSA-9r54-q6cx-xmh5": [ "CVE-2026-24771" ], "GHSA-9vqf-7f2p-gf9v": [ "CVE-2026-44456" ], "GHSA-f577-qrjj-4474": [ "CVE-2026-47673" ], "GHSA-f67f-6cw9-8mq4": [ "CVE-2026-22817" ], "GHSA-f886-m6hf-6m8v": [ "CVE-2026-33750" ], "GHSA-g8m3-5g58-fq7m": [ "CVE-2026-11525" ], "GHSA-g9mf-h72j-4rw9": [ "CVE-2026-22036" ], "GHSA-gq3j-xvxp-8hrf": [ "CVE-2026-56764" ], "GHSA-hm8q-7f3q-5f36": [ "CVE-2026-44459" ], "GHSA-hmw2-7cc7-3qxx": [ "CVE-2026-12143" ], "GHSA-j3q9-mxjg-w52f": [ "CVE-2026-4926" ], "GHSA-j6c9-x7qj-28xf": [ "CVE-2026-54287" ], "GHSA-p6xx-57qc-3wxr": [ "CVE-2026-29085" ], "GHSA-p77w-8qqv-26rm": [ "CVE-2026-44457" ], "GHSA-p88m-4jfj-68fv": [ "CVE-2026-9679" ], "GHSA-q3j6-qgpj-74h6": [ "CVE-2026-6321" ], "GHSA-q5qw-h33p-qvwr": [ "CVE-2026-29045" ], "GHSA-q8mj-m7cp-5q26": [ "CVE-2026-8723" ], "GHSA-qp7p-654g-cw7p": [ "CVE-2026-44458" ], "GHSA-r354-f388-2fhh": [ "CVE-2026-24398" ], "GHSA-r5rp-j6wh-rvv4": [ "CVE-2026-39410" ], "GHSA-rv63-4mwf-qqc2": [ "CVE-2026-54288" ], "GHSA-rwvc-j5jr-mgvh": [ "CVE-2025-48985" ], "GHSA-v39h-62p7-jpjc": [ "CVE-2026-6322" ], "GHSA-v422-hmwv-36x6": [ "CVE-2026-12590" ], "GHSA-v8w9-8mx6-g223": [ "CVE-2026-56763" ], "GHSA-v9p9-hfj2-hcw8": [ "CVE-2026-2229" ], "GHSA-vrm6-8vpv-qv8q": [ "CVE-2026-1526" ], "GHSA-vxpw-j846-p89q": [ "CVE-2026-12151" ], "GHSA-w332-q679-j88p": [ "CVE-2026-24473" ], "GHSA-w7fw-mjwx-w883": [ "CVE-2026-2391" ], "GHSA-wc8c-qw6v-h7f6": [ "CVE-2026-29087" ], "GHSA-wgpf-jwqj-8h8p": [ "CVE-2026-54289" ], "GHSA-wmmm-f939-6g9c": [ "CVE-2026-39407" ], "GHSA-wwfh-h76j-fc44": [ "CVE-2026-54286" ], "GHSA-xf4j-xp2r-rqqx": [ "CVE-2026-39408" ], "GHSA-xpcf-pg52-r92g": [ "CVE-2026-39409" ], "GHSA-xrhx-7g5j-rcj5": [ "CVE-2026-47674" ] }, "cross_scanner_correlation": { "only_osv": [ "GHSA-23c5-xmqv-rm74", "GHSA-3jxr-9vmj-r5cp", "GHSA-3ppc-4f35-3m26", "GHSA-7r86-cg39-jmmj", "GHSA-f886-m6hf-6m8v" ], "only_trivy": [], "intersection_ids": [ "CVE-2025-15284", "CVE-2025-48985", "CVE-2025-69873", "CVE-2025-9910", "CVE-2026-0621", "CVE-2026-11525", "CVE-2026-12143", "CVE-2026-12151", "CVE-2026-12590", "CVE-2026-1525", "CVE-2026-1526", "CVE-2026-1527", "CVE-2026-22036", "CVE-2026-2229", "CVE-2026-22817", "CVE-2026-22818", "CVE-2026-2391", "CVE-2026-24398", "CVE-2026-24472", "CVE-2026-24473", "CVE-2026-24771", "CVE-2026-25536", "CVE-2026-29045", "CVE-2026-29085", "CVE-2026-29086", "CVE-2026-29087", "CVE-2026-39406", "CVE-2026-39407", "CVE-2026-39408", "CVE-2026-39409", "CVE-2026-39410", "CVE-2026-44455", "CVE-2026-44456", "CVE-2026-44457", "CVE-2026-44458", "CVE-2026-44459", "CVE-2026-47673", "CVE-2026-47674", "CVE-2026-47675", "CVE-2026-47676", "CVE-2026-4923", "CVE-2026-4926", "CVE-2026-54286", "CVE-2026-54287", "CVE-2026-54288", "CVE-2026-54289", "CVE-2026-54290", "CVE-2026-56761", "CVE-2026-6321", "CVE-2026-6322", "CVE-2026-6733", "CVE-2026-8723", "CVE-2026-8769", "CVE-2026-9679", "GHSA-26pp-8wgv-hjvm", "GHSA-gq3j-xvxp-8hrf", "GHSA-v8w9-8mx6-g223" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ] ```