Bug #16662: [Organisation] Missing snackbar when downloading the SSO IdP/SP metadata file.

[Salimdev]

[Orga]Absence du snackbar lors du téléchargement du fichier Métadonnées SSO IDP/SP

Summary by CodeRabbit

• User Experience
  • Added a notification confirming that identity provider metadata downloads have started.
  • Download behavior remains unchanged while providing clearer feedback during the download process.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a03a4b6e-ad2d-48c6-b16e-510bb5a15d09

📥 Commits

Reviewing files that changed from the base of the PR and between 7453231 and 4c0c833.

📒 Files selected for processing (1)

• ui/ui-frontend/projects/identity/src/app/customer/customer-preview/sso-tab/sso-tab.component.spec.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

SsoTabComponent injects SnackBarService and notifies it after identity provider metadata download processing starts. The component test provides a mock service.

Changes

SSO download notification

Layer / File(s)	Summary
Download notification wiring ui/ui-frontend/projects/identity/src/app/customer/customer-preview/sso-tab/sso-tab.component.ts, ui/ui-frontend/projects/identity/src/app/customer/customer-preview/sso-tab/sso-tab.component.spec.ts	SsoTabComponent injects SnackBarService and calls notifyDownloadStarted() after loading the downloaded metadata blob. The test configuration provides a mock service.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 4c0c8

SSO metadata downloads now show the expected start notification. The change is limited to notification wiring and test setup, with no remaining merge-blocking risk identified.

Suggested reviewers: marob

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description states the bug but does not follow the repository template. It omits the change type, documentation, tests, migration, checklist, and contributor information.	Complete the required template sections. Describe the implementation, select the Correction change type, state the documentation impact, explain the tests performed, indicate whether migration is required, complete the checklist, and identi…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the organisation module, the missing snackbar, and the affected SSO IdP/SP metadata download.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Resolution

Complete the required template sections. Describe the implementation, select the Correction change type, state the documentation impact, explain the tests performed, indicate whether migration is required, complete the checklist, and identify the contributor.

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bug_16662

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vitam-prg]

Checkmarx One – Scan Summary & Details – 36650597-47d1-4f25-8037-43f21cd97851

---

New Issues (123)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2026-13697	Npm-undici-7.24.4	details Recommended version: 7.29.0 Description: undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 prior to 7.29.0 and 8.0.0 prior to 8.9.0, a respo... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
2		CVE-2026-41293	Maven-org.apache.tomcat.embed:tomcat-embed-core-11.0.21	details Recommended version: 11.0.22 Description: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
3		CVE-2026-43512	Maven-org.apache.tomcat.embed:tomcat-embed-core-11.0.21	details Recommended version: 11.0.22 Description: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
4		CVE-2026-43515	Maven-org.apache.tomcat.embed:tomcat-embed-core-11.0.21	details Recommended version: 11.0.22 Description: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue aff... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
5		CVE-2026-47890	Maven-org.springframework:spring-webmvc-7.0.7	details Recommended version: 7.0.9 Description: Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
6		CVE-2026-47890	Maven-org.springframework:spring-webflux-7.0.7	details Recommended version: 7.0.9 Description: Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
7		CVE-2026-47891	Maven-org.springframework:spring-webflux-7.0.7	details Recommended version: 7.0.9 Description: A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
8		CVE-2026-47892	Maven-org.springframework:spring-webflux-7.0.7	details Recommended version: 7.0.9 Description: A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
9		CVE-2026-53434	Maven-org.apache.tomcat.embed:tomcat-embed-core-11.0.21	details Recommended version: 11.0.23 Description: Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apa... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
10		CVE-2026-55276	Maven-org.apache.tomcat.embed:tomcat-embed-core-11.0.21	details Recommended version: 11.0.23 Description: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not i... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
11		CVE-2026-71290	Maven-org.apache.httpcomponents.client5:httpclient5-5.5.2	details Recommended version: 5.6.4 Description: Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 through 5.6.3. HostnameVerificationPolicy#BUILTIN setting has ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
12		CVE-2026-12151	Npm-undici-7.24.4	details Recommended version: 7.28.0 Description: Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
13		CVE-2026-14257	Npm-brace-expansion-1.1.16	details Recommended version: 1.1.17 Description: brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a m... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
14		CVE-2026-14257	Npm-brace-expansion-2.1.2	details Recommended version: 2.1.3 Description: brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a m... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
15		CVE-2026-14257	Npm-brace-expansion-5.0.7	details Recommended version: 5.0.8 Description: brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a m... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
16		CVE-2026-14643	Npm-undici-7.24.4	details Recommended version: 7.29.0 Description: undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
17		CVE-2026-16221	Npm-fast-uri-3.1.3	details Recommended version: 3.1.4 Description: Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backsla... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
18		CVE-2026-18446	Npm-fast-uri-3.1.3	details Recommended version: 3.1.5 Description: fast-uri prior to 2.4.4, 3.0.0 prior to 3.1.5 and 4.0.0 prior to 4.1.2 require a literal double forward slash to recognize a URI authority, so a re... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
19		CVE-2026-40983	Maven-io.micrometer:micrometer-core-1.16.5	details Recommended version: 1.16.6 Description: In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected v... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
20		CVE-2026-40993	Maven-org.springframework.security:spring-security-core-7.0.5	details Recommended version: 7.0.6 Description: An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be ab... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
21		CVE-2026-41284	Maven-org.apache.tomcat.embed:tomcat-embed-core-11.0.21	details Recommended version: 11.0.22 Description: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. Apache Tomcat versions 9.0.0.M1 through 9.0.117, 10.1.0-M1 th... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
22		CVE-2026-41695	Maven-org.springframework.data:spring-data-commons-4.0.5	details Recommended version: 4.0.6 Description: Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
23		CVE-2026-41716	Maven-org.springframework.data:spring-data-commons-4.0.5	details Recommended version: 4.0.6 Description: Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion thro... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
24		CVE-2026-42498	Maven-org.apache.tomcat.embed:tomcat-embed-core-11.0.21	details Recommended version: 11.0.22 Description: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apac... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
25		CVE-2026-42577	Maven-io.netty:netty-transport-native-epoll-4.2.12.Final	details Recommended version: 4.2.13.Final Description: Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect an... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
26		CVE-2026-42582	Maven-io.netty:netty-codec-http3-4.2.12.Final	details Recommended version: 4.2.13.Final Description: When Netty decodes HTTP/3 headers, it sometimes runs `new byte[length]` using a length from the wire before checking that many bytes are really the... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
27		CVE-2026-43513	Maven-org.apache.tomcat.embed:tomcat-embed-core-11.0.21	details Recommended version: 11.0.22 Description: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
28		CVE-2026-44892	Maven-io.netty:netty-codec-http3-4.2.12.Final	details Recommended version: 4.2.15.Final Description: The default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does n... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
29		CVE-2026-44894	Maven-io.netty:netty-codec-classes-quic-4.2.12.Final	details Recommended version: 4.2.15.Final Description: NoQuicTokenHandler is the tokenHandler used when the application does not set one. Its writeToken() returns false (server will not send Retry -- ac... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
30		CVE-2026-47885	Maven-org.springframework:spring-webflux-7.0.7	details Recommended version: 7.0.9 Description: The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 -... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
31		CVE-2026-47889	Maven-org.springframework:spring-web-7.0.7	details Recommended version: 7.0.9 Description: A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the "sameSite" attribute. This issue affect... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
32		CVE-2026-47893	Maven-org.springframework:spring-webflux-7.0.7	details Recommended version: 7.0.9 Description: A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in a... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
33		CVE-2026-48748	Maven-io.netty:netty-codec-http3-4.2.12.Final	details Recommended version: 4.2.15.Final Description: Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, a memory exhaustion vulner... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
34		CVE-2026-50170	Npm-@angular/common-21.2.14	details Recommended version: 21.2.15 Description: A vulnerability was discovered in `@angular/common` when Server-Side Rendering (SSR) and hydration are enabled. The `HttpTransferCache` utility opt... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
35		CVE-2026-50171	Npm-@angular/common-21.2.14	details Recommended version: 21.2.15 Description: A Denial of Service (DoS) vulnerability exists in the `@angular/common` package of Angular. The `formatNumber` function, which is also utilized by ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
36		CVE-2026-53571	Npm-vite-7.3.2	details Recommended version: 7.3.5 Description: The contents of files that are specified by [`server.fs.deny`](https://vite\.dev/config/server\-options\#server\-fs\-deny\) can be returned to the browse... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
37		CVE-2026-54264	Npm-@angular/service-worker-21.2.14	details Recommended version: 21.2.17 Description: An information disclosure vulnerability exists in the `@angular/service-worker` package of the Angular framework. When the Service Worker fetches a... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
38		CVE-2026-54266	Npm-@angular/common-21.2.14	details Recommended version: 21.2.17 Description: Angular's `HttpTransferCache` caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
39		CVE-2026-54267	Npm-@angular/core-21.2.14	details Recommended version: 21.2.17 Description: To optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via `provideClientHydration()`. During SSR... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
40		CVE-2026-54268	Npm-@angular/common-21.2.14	details Recommended version: 21.2.17 Description: A Denial of Service (DoS) vulnerability exists in the `@angular/common` package of the Angular framework. The `formatDate` function, which is also ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
41		CVE-2026-55388	Npm-piscina-5.1.4	details Recommended version: 5.2.0 Description: `piscina`'s constructor and `run()` paths read the `filename` option via plain member access. Both reads fall through the prototype chain when the ... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
42		CVE-2026-55603	Npm-http-proxy-middleware-3.0.5	details Recommended version: 3.0.7 Description: fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Co... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
43		CVE-2026-59324	Maven-org.springframework.integration:spring-integration-core-7.0.4	details Recommended version: 7.0.6 Description: When an IntegrationFlow uses '.fluxTransform()' with an asynchronous/reordering 'fluxFunction' that emits raw payloads, concurrent requests on the ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
44		CVE-2026-67213	Npm-nanoid-3.3.16	details Recommended version: 3.3.17 Description: nanoid (Nano ID) prior to 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured wit... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
45		CVE-2026-67214	Npm-nanoid-3.3.16	details Recommended version: 3.3.17 Description: nanoid (Nano ID) prior to 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
46		CVE-2026-6734	Npm-undici-7.24.4	details Recommended version: 7.28.0 Description: Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin match... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
47		CVE-2026-68945	Npm-@angular/common-21.2.14	details Recommended version: 21.2.19 Description: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.2... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
48		CVE-2026-69151	Npm-@angular/compiler-21.2.14	details Recommended version: 21.2.19 Description: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.2... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
49		CVE-2026-69151	Npm-@angular/core-21.2.14	details Recommended version: 21.2.19 Description: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.2... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
50		CVE-2026-69152	Npm-brace-expansion-1.1.16	details Recommended version: 1.1.18 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.x prior to 2.1.4, 3.x prior to 3.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
51		CVE-2026-69152	Npm-brace-expansion-2.1.2	details Recommended version: 2.1.4 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.x prior to 2.1.4, 3.x prior to 3.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
52		CVE-2026-69152	Npm-brace-expansion-5.0.7	details Recommended version: 5.0.9 Description: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.x prior to 2.1.4, 3.x prior to 3.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
53		CVE-2026-69192	Npm-ip-address-10.2.0	details Recommended version: 10.3.1 Description: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
54		CVE-2026-73088	Npm-browserslist-4.28.6	details Recommended version: 4.28.7 Description: Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, "normalizeStats()" ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
55		CVE-2026-73089	Npm-browserslist-4.28.6	details Recommended version: 4.28.7 Description: Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains ev... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
56		CVE-2026-73566	Npm-tar-7.5.20	details Recommended version: 7.5.21 Description: node-tar is a tar archive manipulation library for Node.js. Prior to version 7.5.21, node-tar's `filesFilter` in `src/list.ts` uses the recursive `... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
57		CVE-2026-73646	Npm-postcss-8.5.12	details Recommended version: 8.5.18 Description: PostCSS auto-detects a '/*# sourceMappingURL=... */' comment inside the CSS text it is asked to parse and, unless the caller explicitly passes 'map... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
58		CVE-2026-75899	Npm-fast-uri-3.1.3	details Recommended version: 3.1.6 Description: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time du... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
59		CVE-2026-75931	Npm-fast-uri-3.1.3	details Recommended version: 3.1.6 Description: fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relativ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
60		CVE-2026-75975	Npm-fast-uri-3.1.3	details Recommended version: 3.1.6 Description: fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailin... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
61		CVE-2026-76172	Npm-fast-uri-3.1.3	details Recommended version: 3.1.6 Description: fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
62		CVE-2026-84292	Npm-fast-uri-3.1.3	details Recommended version: 3.1.7 Description: fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
63		CVE-2026-84375	Npm-js-yaml-4.3.0	details Recommended version: 4.3.2 Description: js-yaml is a JavaScript YAML parser and dumper. In versions 3.0.0 prior to 3.15.2 and 4.x prior to 4.3.2, `maxTotalMergeKeys` in `lib/js-yaml/loade... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
64		CVE-2026-9496	Npm-pacote-21.3.1	details Recommended version: 21.5.1 Description: Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
65		CVE-2026-9697	Npm-undici-7.24.4	details Recommended version: 7.28.0 Description: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connecti... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
66		Cx0e1b35ca-f68b	Npm-js-yaml-4.3.0	details Recommended version: 4.3.1 Description: "resolveYamlOmap()" enforces key uniqueness for !!omap sequences with a linear scan (objectKeys.indexOf(...)) inside the per-element loop, making r... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
67		Cxe63a43db-ca6e	Maven-tools.jackson.core:jackson-core-3.1.0	details Recommended version: 3.1.4 Description: Jackson Core 3.x does not consistently enforce `StreamReadConstraints.maxDocumentLength`. Oversized JSON documents can be accepted without a `Strea... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
68		CVE-2026-14620	Npm-webpack-dev-server-5.2.3	details Recommended version: 5.2.6 Description: webpack-dev-server versions through 5.2.5 expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalida... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
69		CVE-2026-14631	Npm-webpack-dev-server-5.2.3	details Recommended version: 5.2.6 Description: webpack-dev-server versions through 5.2.5 terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
70		CVE-2026-15157	Npm-undici-6.27.0	details Recommended version: 6.28.0 Description: undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispat... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
71		CVE-2026-15157	Npm-undici-7.24.4	details Recommended version: 7.29.0 Description: undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispat... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
72		CVE-2026-16728	Npm-undici-6.27.0	details Recommended version: 6.28.0 Description: undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a ret... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
73		CVE-2026-16728	Npm-undici-7.24.4	details Recommended version: 7.29.0 Description: undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a ret... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
74		CVE-2026-16729	Npm-undici-6.27.0	details Recommended version: 6.28.0 Description: undici's setCookie function does not fully sanitize cookie attributes. In undici versions prior to 6.28.0, 7.0.0 prior to 7.29.0, and 8.0.0 prior t... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
75		CVE-2026-16729	Npm-undici-7.24.4	details Recommended version: 7.29.0 Description: undici's setCookie function does not fully sanitize cookie attributes. In undici versions prior to 6.28.0, 7.0.0 prior to 7.29.0, and 8.0.0 prior t... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
76		CVE-2026-19032	Maven-com.fasterxml.jackson.core:jackson-databind-2.21.3	details Recommended version: 2.21.4.redhat-00001 Description: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeseri... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
77		CVE-2026-40992	Maven-org.springframework.boot:spring-boot-autoconfigure-4.0.6	details Recommended version: 4.0.7 Description: Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.m... Attack Vector: ADJACENT_NETWORK Attack Complexity: HIGH Vulnerable Package
78		CVE-2026-41001	Maven-org.springframework.boot:spring-boot-autoconfigure-4.0.6	details Recommended version: 4.0.7 Description: Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explic... Attack Vector: LOCAL Attack Complexity: LOW Vulnerable Package
79		CVE-2026-41003	Maven-org.springframework.security:spring-security-core-7.0.5	details Recommended version: 7.0.6 Description: An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filte... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
80		CVE-2026-41839	Maven-org.springframework:spring-webflux-7.0.7	details Recommended version: 7.0.8 Description: A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack ... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package

More results are available on the CxOne platform

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR