[VANTA] [VULNERABILITY] <MEDIUM> CVE-2025-62718, CVE-2026-40175, CVE-2026-67312 and others, fix before 2026-11-02

> [!IMPORTANT]
> CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.
>
> DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

`npm-axios >= 1.0.0, < 1.15.0` CODE_REPOSITORY/examples <ins>CVE-2026-40175</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/563

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx
> - https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1
> - https://github.com/axios/axios/releases/tag/v1.15.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-40175
> - https://github.com/axios/axios/pull/10660
> - https://github.com/axios/axios/pull/10660#issuecomment-4224168081
> - https://github.com/axios/axios/pull/10688
> - https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c
> - https://github.com/axios/axios/releases/tag/v0.31.0
> - https://cert-portal.siemens.com/productcert/html/ssa-876049.html
> - https://github.com/advisories/GHSA-fvcv-3m26-pcqx
> 
> </details>

`npm-axios >= 1.0.0, < 1.15.0` CODE_REPOSITORY/examples <ins>CVE-2025-62718</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/572

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5
> - https://nvd.nist.gov/vuln/detail/CVE-2025-62718
> - https://github.com/axios/axios/pull/10661
> - https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df
> - https://datatracker.ietf.org/doc/html/rfc1034#section-3.1
> - https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
> - https://github.com/axios/axios/releases/tag/v1.15.0
> - https://github.com/axios/axios/pull/10688
> - https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c
> - https://github.com/axios/axios/releases/tag/v0.31.0
> - https://github.com/advisories/GHSA-3p68-rc4w-qgx5
> 
> </details>

`npm-axios >= 1.0.0, < 1.18.0` CODE_REPOSITORY/examples <ins>CVE-2026-67312</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/913

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72
> - https://github.com/axios/axios/pull/11000
> - https://github.com/axios/axios/pull/11001
> - https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d
> - https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
> - https://github.com/axios/axios/releases/tag/v0.33.0
> - https://github.com/axios/axios/releases/tag/v1.18.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-67312
> - https://nvd.nist.gov/vuln/detail/CVE-2026-68941
> - https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson
> - https://github.com/advisories/GHSA-pmv8-rq9r-6j72
> 
> </details>

`npm-axios >= 1.0.0, < 1.18.0` CODE_REPOSITORY/examples <ins>CVE-2026-67313</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/915

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3
> - https://github.com/axios/axios/pull/11000
> - https://github.com/axios/axios/pull/11001
> - https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d
> - https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
> - https://github.com/axios/axios/releases/tag/v0.33.0
> - https://github.com/axios/axios/releases/tag/v1.18.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-67313
> - https://nvd.nist.gov/vuln/detail/CVE-2026-68942
> - https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson
> - https://github.com/advisories/GHSA-42h9-826w-cgv3
> 
> </details>

`npm-axios >= 1.0.0, < 1.18.0` CODE_REPOSITORY/examples <ins>CVE-2026-67316</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/922

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx
> - https://github.com/axios/axios/pull/11000
> - https://github.com/axios/axios/pull/11001
> - https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d
> - https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
> - https://github.com/axios/axios/releases/tag/v0.33.0
> - https://github.com/axios/axios/releases/tag/v1.18.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-67316
> - https://nvd.nist.gov/vuln/detail/CVE-2026-68944
> - https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods
> - https://github.com/advisories/GHSA-mmx7-hfxf-jppx
> 
> </details>

`npm-axios >= 1.0.0, < 1.18.0` CODE_REPOSITORY/examples <ins>CVE-2026-67319</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/924

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq
> - https://github.com/axios/axios/pull/11000
> - https://github.com/axios/axios/pull/11001
> - https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d
> - https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
> - https://github.com/axios/axios/releases/tag/v0.33.0
> - https://github.com/axios/axios/releases/tag/v1.18.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-67319
> - https://nvd.nist.gov/vuln/detail/CVE-2026-69123
> - https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects
> - https://github.com/advisories/GHSA-7q8q-rj6j-mhjq
> 
> </details>

</details>
<details><summary>FIXED <code>npm-react-router >= 6.4.0, < 7.18.0</code> <ins>CVE-2026-53666</ins> MEDIUM</summary>

`npm-react-router >= 6.4.0, < 7.18.0` CODE_REPOSITORY/examples <ins>CVE-2026-53666</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/960

> <details><summary>Related URLs</summary>
> 
> - https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxg
> - https://github.com/remix-run/react-router/pull/15175
> - https://github.com/remix-run/react-router/commit/9d22943fd46c8ae4b08236425fa3549e10e9ad1a
> - https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
> - https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
> - https://github.com/advisories/GHSA-337j-9hxr-rhxg
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 10.0.0, < 14.2.7</code> <ins>CVE-2024-47831</ins> MEDIUM</summary>

`npm-next >= 10.0.0, < 14.2.7` CODE_REPOSITORY/examples <ins>CVE-2024-47831</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/182

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m
> - https://nvd.nist.gov/vuln/detail/CVE-2024-47831
> - https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a
> - https://github.com/advisories/GHSA-g77x-44xx-532m
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 10.0.0, < 15.5.10</code> <ins>CVE-2025-59471</ins> MEDIUM</summary>

`npm-next >= 10.0.0, < 15.5.10` CODE_REPOSITORY/examples <ins>CVE-2025-59471</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/361

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f
> - https://nvd.nist.gov/vuln/detail/CVE-2025-59471
> - https://github.com/vercel/next.js/commit/500ec83743639addceaede95e95913398975156c
> - https://github.com/vercel/next.js/commit/e5b834d208fe0edf64aa26b5d76dcf6a176500ec
> - https://github.com/vercel/next.js/releases/tag/v15.5.10
> - https://github.com/vercel/next.js/releases/tag/v16.1.5
> - https://github.com/advisories/GHSA-9g9p-9gw9-jx7f
> 
> </details>

</details>

<details><summary>FIXED <code>npm-h3 <= 1.15.8</code> <ins>GHSA-72gr-qfp7-vwhw</ins> MEDIUM</summary>

`npm-h3 <= 1.15.8` CODE_REPOSITORY/examples <ins>GHSA-72gr-qfp7-vwhw</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/463

> <details><summary>Related URLs</summary>
> 
> - https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw
> - https://github.com/advisories/GHSA-72gr-qfp7-vwhw
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 10.0.0, < 15.5.16</code> <ins>CVE-2026-44577</ins> MEDIUM</summary>

`npm-next >= 10.0.0, < 15.5.16` CODE_REPOSITORY/examples <ins>CVE-2026-44577</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/739

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh
> - https://github.com/vercel/next.js/releases/tag/v15.5.16
> - https://github.com/vercel/next.js/releases/tag/v16.2.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44577
> - https://github.com/advisories/GHSA-h64f-5h5j-jqjh
> 
> </details>

</details>

<details><summary>FIXED <code>npm-@hono/node-server >= 2.0.0, < 2.0.5</code> <ins>GHSA-frvp-7c67-39w9</ins> MEDIUM</summary>

`npm-@hono/node-server >= 2.0.0, < 2.0.5` CODE_REPOSITORY/examples <ins>GHSA-frvp-7c67-39w9</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/1071

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/node-server/security/advisories/GHSA-frvp-7c67-39w9
> - https://github.com/honojs/node-server/commit/cd076e117cfe4cb8d31f9eb11d2e8f38a6cb8faf
> - https://github.com/honojs/node-server/releases/tag/v2.0.5
> - https://github.com/advisories/GHSA-frvp-7c67-39w9
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 14.2.0, < 15.5.16</code> <ins>CVE-2026-44576</ins> MEDIUM</summary>

`npm-next >= 14.2.0, < 15.5.16` CODE_REPOSITORY/examples <ins>CVE-2026-44576</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/705

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7
> - https://github.com/vercel/next.js/releases/tag/v15.5.16
> - https://github.com/vercel/next.js/releases/tag/v16.2.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44576
> - https://github.com/advisories/GHSA-wfc6-r584-vfw7
> 
> </details>

</details>

<details><summary>FIXED <code>npm-postcss < 8.4.31</code> <ins>CVE-2023-44270</ins> MEDIUM</summary>

`npm-postcss < 8.4.31` CODE_REPOSITORY/examples <ins>CVE-2023-44270</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/25

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2023-44270
> - https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
> - https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25
> - https://github.com/postcss/postcss/releases/tag/8.4.31
> - https://github.com/github/advisory-database/issues/2820
> - https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
> - https://github.com/advisories/GHSA-7fh5-64p2-3v2j
> 
> </details>

</details>

<details><summary>FIXED <code>npm-micromatch < 4.0.8</code> <ins>CVE-2024-4067</ins> MEDIUM</summary>

`npm-micromatch < 4.0.8` CODE_REPOSITORY/examples <ins>CVE-2024-4067</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/135

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2024-4067
> - https://github.com/micromatch/micromatch/issues/243
> - https://github.com/micromatch/micromatch/pull/247
> - https://devhub.checkmarx.com/cve-details/CVE-2024-4067
> - https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448
> - https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0
> - https://github.com/micromatch/micromatch/pull/266
> - https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade
> - https://advisory.checkmarx.net/advisory/CVE-2024-4067
> - https://github.com/micromatch/micromatch/releases/tag/4.0.8
> - https://github.com/advisories/GHSA-952p-6rrq-rcjv
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 13.0.0, < 13.5.8</code> <ins>CVE-2024-56332</ins> MEDIUM</summary>

`npm-next >= 13.0.0, < 13.5.8` CODE_REPOSITORY/examples <ins>CVE-2024-56332</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/140

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-7m27-7ghc-44w9
> - https://nvd.nist.gov/vuln/detail/CVE-2024-56332
> - https://github.com/advisories/GHSA-7m27-7ghc-44w9
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 14.0.0, < 14.2.21</code> <ins>CVE-2024-56332</ins> MEDIUM</summary>

`npm-next >= 14.0.0, < 14.2.21` CODE_REPOSITORY/examples <ins>CVE-2024-56332</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/186

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-7m27-7ghc-44w9
> - https://nvd.nist.gov/vuln/detail/CVE-2024-56332
> - https://github.com/advisories/GHSA-7m27-7ghc-44w9
> 
> </details>

</details>

<details><summary>FIXED <code>npm-h3 < 1.15.9</code> <ins>GHSA-4hxc-9384-m385</ins> MEDIUM</summary>

`npm-h3 < 1.15.9` CODE_REPOSITORY/examples <ins>GHSA-4hxc-9384-m385</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/464

> <details><summary>Related URLs</summary>
> 
> - https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385
> - https://github.com/advisories/GHSA-4hxc-9384-m385
> 
> </details>

</details>

<details><summary>FIXED <code>npm-qs >= 6.11.1, <= 6.15.1</code> <ins>CVE-2026-8723</ins> MEDIUM</summary>

`npm-qs >= 6.11.1, <= 6.15.1` CODE_REPOSITORY/examples <ins>CVE-2026-8723</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/752

> <details><summary>Related URLs</summary>
> 
> - https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26
> - https://nvd.nist.gov/vuln/detail/CVE-2026-8723
> - https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41
> - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
> 
> </details>

</details>

<details><summary>FIXED <code>npm-joi < 17.13.4</code> <ins>CVE-2026-48038</ins> MEDIUM</summary>

`npm-joi < 17.13.4` CODE_REPOSITORY/examples <ins>CVE-2026-48038</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/838

> <details><summary>Related URLs</summary>
> 
> - https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79
> - https://github.com/hapijs/joi/pull/3113
> - https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11
> - https://github.com/advisories/GHSA-q7cg-457f-vx79
> 
> </details>

</details>

<details><summary>FIXED <code>npm-morgan >= 1.2.0, <= 1.10.1</code> <ins>CVE-2026-5078</ins> MEDIUM</summary>

`npm-morgan >= 1.2.0, <= 1.10.1` CODE_REPOSITORY/examples <ins>CVE-2026-5078</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/880

> <details><summary>Related URLs</summary>
> 
> - https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m
> - https://nvd.nist.gov/vuln/detail/CVE-2026-5078
> - https://cna.openjsf.org/security-advisories.html
> - https://github.com/advisories/GHSA-4vj7-5mj6-jm8m
> 
> </details>

</details>

<details><summary>FIXED <code>npm-@hono/node-server >= 2.0.0, <= 2.0.9</code> <ins>CVE-2026-73565</ins> MEDIUM</summary>

`npm-@hono/node-server >= 2.0.0, <= 2.0.9` CODE_REPOSITORY/examples <ins>CVE-2026-73565</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/920

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg
> - https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1
> - https://github.com/honojs/node-server/releases/tag/v2.0.10
> - https://github.com/advisories/GHSA-9mqv-5hh9-4cgg
> 
> </details>

</details>

<details><summary>FIXED <code>npm-hono < 4.12.34</code> <ins>CVE-2026-69207</ins> MEDIUM</summary>

`npm-hono < 4.12.34` CODE_REPOSITORY/examples <ins>CVE-2026-69207</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/1035

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239
> - https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5
> - https://github.com/honojs/hono/releases/tag/v4.12.34
> - https://github.com/advisories/GHSA-8j4g-w8fx-2239
> 
> </details>

</details>

<details><summary>FIXED <code>npm-hono >= 4.12.0, < 4.12.34</code> <ins>CVE-2026-71848</ins> MEDIUM</summary>

`npm-hono >= 4.12.0, < 4.12.34` CODE_REPOSITORY/examples <ins>CVE-2026-71848</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/1051

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-54fx-42gc-7vw4
> - https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7
> - https://github.com/honojs/hono/releases/tag/v4.12.34
> - https://github.com/advisories/GHSA-54fx-42gc-7vw4
> 
> </details>

</details>

<details><summary>FIXED <code>npm-axios < 0.31.0</code> <ins>CVE-2026-40175</ins> MEDIUM</summary>

`npm-axios < 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2026-40175</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/564

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx
> - https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1
> - https://github.com/axios/axios/releases/tag/v1.15.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-40175
> - https://github.com/axios/axios/pull/10660
> - https://github.com/axios/axios/pull/10660#issuecomment-4224168081
> - https://github.com/axios/axios/pull/10688
> - https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c
> - https://github.com/axios/axios/releases/tag/v0.31.0
> - https://cert-portal.siemens.com/productcert/html/ssa-876049.html
> - https://github.com/advisories/GHSA-fvcv-3m26-pcqx
> 
> </details>

</details>

<details><summary>FIXED <code>npm-axios < 0.31.0</code> <ins>CVE-2025-62718</ins> MEDIUM</summary>

`npm-axios < 0.31.0` CODE_REPOSITORY/examples <ins>CVE-2025-62718</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/573

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5
> - https://nvd.nist.gov/vuln/detail/CVE-2025-62718
> - https://github.com/axios/axios/pull/10661
> - https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df
> - https://datatracker.ietf.org/doc/html/rfc1034#section-3.1
> - https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
> - https://github.com/axios/axios/releases/tag/v1.15.0
> - https://github.com/axios/axios/pull/10688
> - https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c
> - https://github.com/axios/axios/releases/tag/v0.31.0
> - https://github.com/advisories/GHSA-3p68-rc4w-qgx5
> 
> </details>

</details>

<details><summary>FIXED <code>npm-hono >= 4.3.3, < 4.12.27</code> <ins>CVE-2026-59897</ins> MEDIUM</summary>

`npm-hono >= 4.3.3, < 4.12.27` CODE_REPOSITORY/examples <ins>CVE-2026-59897</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/917

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-xgm2-5f3f-mvvc
> - https://nvd.nist.gov/vuln/detail/CVE-2026-59897
> - https://github.com/honojs/hono/commit/aa921770d09bc35970362d5a2630a878f6d982fd
> - https://github.com/honojs/hono/releases/tag/v4.12.27
> - https://github.com/advisories/GHSA-xgm2-5f3f-mvvc
> 
> </details>

</details>

<details><summary>FIXED <code>npm-hono >= 3.8.0, < 4.12.34</code> <ins>CVE-2026-71850</ins> MEDIUM</summary>

`npm-hono >= 3.8.0, < 4.12.34` CODE_REPOSITORY/examples <ins>CVE-2026-71850</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/1054

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-f23p-vx2j-j53r
> - https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f
> - https://github.com/honojs/hono/releases/tag/v4.12.34
> - https://github.com/advisories/GHSA-f23p-vx2j-j53r
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 13.4.0, < 15.5.16</code> <ins>CVE-2026-44581</ins> MEDIUM</summary>

`npm-next >= 13.4.0, < 15.5.16` CODE_REPOSITORY/examples <ins>CVE-2026-44581</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/767

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q
> - https://github.com/vercel/next.js/releases/tag/v15.5.16
> - https://github.com/vercel/next.js/releases/tag/v16.2.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44581
> - https://github.com/advisories/GHSA-ffhc-5mcf-pf4q
> 
> </details>

</details>

<details><summary>FIXED <code>npm-nanoid < 3.3.8</code> <ins>CVE-2024-55565</ins> MEDIUM</summary>

`npm-nanoid < 3.3.8` CODE_REPOSITORY/examples <ins>CVE-2024-55565</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/184

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2024-55565
> - https://github.com/ai/nanoid/pull/510
> - https://github.com/ai/nanoid/compare/3.3.7...3.3.8
> - https://github.com/ai/nanoid/releases/tag/5.0.9
> - https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
> - https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html
> - https://github.com/advisories/GHSA-mwcw-c2x4-8c55
> 
> </details>

</details>

<details><summary>FIXED <code>npm-yaml >= 2.0.0, < 2.8.3</code> <ins>CVE-2026-33532</ins> MEDIUM</summary>

`npm-yaml >= 2.0.0, < 2.8.3` CODE_REPOSITORY/examples <ins>CVE-2026-33532</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/483

> <details><summary>Related URLs</summary>
> 
> - https://github.com/eemeli/yaml/security/advisories/GHSA-48c2-rrv3-qjmp
> - https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b
> - https://github.com/eemeli/yaml/releases/tag/v1.10.3
> - https://github.com/eemeli/yaml/releases/tag/v2.8.3
> - https://nvd.nist.gov/vuln/detail/CVE-2026-33532
> - https://github.com/advisories/GHSA-48c2-rrv3-qjmp
> 
> </details>

</details>

<details><summary>FIXED <code>npm-qs < 6.14.1</code> <ins>CVE-2025-15284</ins> MEDIUM</summary>

`npm-qs < 6.14.1` CODE_REPOSITORY/examples <ins>CVE-2025-15284</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/327

> <details><summary>Related URLs</summary>
> 
> - https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p
> - https://nvd.nist.gov/vuln/detail/CVE-2025-15284
> - https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9
> - https://github.com/advisories/GHSA-6rw7-vpxm-498p
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 9.5.0, < 15.5.13</code> <ins>CVE-2026-29057</ins> MEDIUM</summary>

`npm-next >= 9.5.0, < 15.5.13` CODE_REPOSITORY/examples <ins>CVE-2026-29057</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/471

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8
> - https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6
> - https://github.com/vercel/next.js/releases/tag/v15.5.13
> - https://github.com/vercel/next.js/releases/tag/v16.1.7
> - https://nvd.nist.gov/vuln/detail/CVE-2026-29057
> - https://github.com/advisories/GHSA-ggv3-7p47-pfv8
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 10.0.0, < 15.5.14</code> <ins>CVE-2026-27980</ins> MEDIUM</summary>

`npm-next >= 10.0.0, < 15.5.14` CODE_REPOSITORY/examples <ins>CVE-2026-27980</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/477

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8
> - https://github.com/vercel/next.js/commit/39eb8e0ac498b48855a0430fbf4c22276a73b4bd
> - https://github.com/vercel/next.js/releases/tag/v16.1.7
> - https://nvd.nist.gov/vuln/detail/CVE-2026-27980
> - https://github.com/advisories/GHSA-3x4c-7xq6-9pq8
> 
> </details>

</details>

<details><summary>FIXED <code>npm-follow-redirects <= 1.15.11</code> <ins>GHSA-r4q5-vmmm-2653</ins> MEDIUM</summary>

`npm-follow-redirects <= 1.15.11` CODE_REPOSITORY/examples <ins>GHSA-r4q5-vmmm-2653</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/557

> <details><summary>Related URLs</summary>
> 
> - https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653
> - https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9
> - https://github.com/advisories/GHSA-r4q5-vmmm-2653
> 
> </details>

</details>

<details><summary>FIXED <code>npm-axios >= 1.7.0, < 1.18.0</code> <ins>CVE-2026-67317</ins> MEDIUM</summary>

`npm-axios >= 1.7.0, < 1.18.0` CODE_REPOSITORY/examples <ins>CVE-2026-67317</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/891

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9
> - https://github.com/axios/axios/pull/11000
> - https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
> - https://github.com/axios/axios/releases/tag/v1.18.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-67317
> - https://nvd.nist.gov/vuln/detail/CVE-2026-68947
> - https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream
> - https://github.com/advisories/GHSA-jqh4-m9w3-8hp9
> 
> </details>

</details>

<details><summary>FIXED <code>npm-axios < 0.33.0</code> <ins>CVE-2026-67316</ins> MEDIUM</summary>

`npm-axios < 0.33.0` CODE_REPOSITORY/examples <ins>CVE-2026-67316</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/936

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx
> - https://github.com/axios/axios/pull/11000
> - https://github.com/axios/axios/pull/11001
> - https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d
> - https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
> - https://github.com/axios/axios/releases/tag/v0.33.0
> - https://github.com/axios/axios/releases/tag/v1.18.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-67316
> - https://nvd.nist.gov/vuln/detail/CVE-2026-68944
> - https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods
> - https://github.com/advisories/GHSA-mmx7-hfxf-jppx
> 
> </details>

</details>

<details><summary>FIXED <code>npm-axios >= 0.8.0, < 0.33.0</code> <ins>CVE-2026-67319</ins> MEDIUM</summary>

`npm-axios >= 0.8.0, < 0.33.0` CODE_REPOSITORY/examples <ins>CVE-2026-67319</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/934

> <details><summary>Related URLs</summary>
> 
> - https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq
> - https://github.com/axios/axios/pull/11000
> - https://github.com/axios/axios/pull/11001
> - https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d
> - https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
> - https://github.com/axios/axios/releases/tag/v0.33.0
> - https://github.com/axios/axios/releases/tag/v1.18.0
> - https://nvd.nist.gov/vuln/detail/CVE-2026-67319
> - https://nvd.nist.gov/vuln/detail/CVE-2026-69123
> - https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects
> - https://github.com/advisories/GHSA-7q8q-rj6j-mhjq
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 15.5.0, < 15.5.21</code> <ins>CVE-2026-64644</ins> MEDIUM</summary>

`npm-next >= 15.5.0, < 15.5.21` CODE_REPOSITORY/examples <ins>CVE-2026-64644</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/946

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
> - https://github.com/vercel/next.js/pull/96006
> - https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
> - https://github.com/vercel/next.js/releases/tag/v15.5.21
> - https://github.com/vercel/next.js/releases/tag/v16.2.11
> - https://github.com/advisories/GHSA-q8wf-6r8g-63ch
> 
> </details>

</details>

<details><summary>FIXED <code>npm-react-router >= 6.0.0, < 7.18.0</code> <ins>CVE-2026-53669</ins> MEDIUM</summary>

`npm-react-router >= 6.0.0, < 7.18.0` CODE_REPOSITORY/examples <ins>CVE-2026-53669</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/964

> <details><summary>Related URLs</summary>
> 
> - https://github.com/remix-run/react-router/security/advisories/GHSA-wrjc-x8rr-h8h6
> - https://github.com/remix-run/react-router/pull/15176
> - https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
> - https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
> - http://github.com/remix-run/react-router/pull/15176
> - https://github.com/advisories/GHSA-wrjc-x8rr-h8h6
> 
> </details>

</details>

<details><summary>FIXED <code>npm-postcss <= 8.5.22</code> <ins>CVE-2026-69153</ins> MEDIUM</summary>

`npm-postcss <= 8.5.22` CODE_REPOSITORY/examples <ins>CVE-2026-69153</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/1070

> <details><summary>Related URLs</summary>
> 
> - https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp
> - https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
> - https://github.com/postcss/postcss/releases/tag/8.5.19
> - https://github.com/advisories/GHSA-fxqj-rqcc-2cmp
> 
> </details>

</details>

<details><summary>FIXED <code>npm-decode-uri-component <= 0.4.2</code> <ins>CVE-2026-45822</ins> MEDIUM</summary>

`npm-decode-uri-component <= 0.4.2` CODE_REPOSITORY/examples <ins>CVE-2026-45822</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/1087

> <details><summary>Related URLs</summary>
> 
> - https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-vcc3-ghjq-m6fr
> - https://nvd.nist.gov/vuln/detail/CVE-2026-45822
> - https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005
> - https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js
> - https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.0
> - https://www.npmjs.com/package/decode-uri-component
> - https://github.com/advisories/GHSA-vcc3-ghjq-m6fr
> 
> </details>

</details>

<details><summary>FIXED <code>npm-express < 4.20.0</code> <ins>CVE-2024-43796</ins> LOW</summary>

`npm-express < 4.20.0` CODE_REPOSITORY/examples <ins>CVE-2024-43796</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/202

> <details><summary>Related URLs</summary>
> 
> - https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx
> - https://nvd.nist.gov/vuln/detail/CVE-2024-43796
> - https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553
> - https://github.com/advisories/GHSA-qw6h-vgh9-j6wx
> 
> </details>

</details>

<details><summary>FIXED <code>npm-serve-static < 1.16.0</code> <ins>CVE-2024-43800</ins> LOW</summary>

`npm-serve-static < 1.16.0` CODE_REPOSITORY/examples <ins>CVE-2024-43800</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/203

> <details><summary>Related URLs</summary>
> 
> - https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p
> - https://nvd.nist.gov/vuln/detail/CVE-2024-43800
> - https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b
> - https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa
> - https://github.com/advisories/GHSA-cm22-4g7w-348p
> 
> </details>

</details>

<details><summary>FIXED <code>npm-send < 0.19.0</code> <ins>CVE-2024-43799</ins> LOW</summary>

`npm-send < 0.19.0` CODE_REPOSITORY/examples <ins>CVE-2024-43799</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/204

> <details><summary>Related URLs</summary>
> 
> - https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg
> - https://nvd.nist.gov/vuln/detail/CVE-2024-43799
> - https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35
> - https://lists.debian.org/debian-lts-announce/2025/06/msg00022.html
> - https://github.com/advisories/GHSA-m6fv-jmcg-4jfg
> 
> </details>

</details>

<details><summary>FIXED <code>npm-postcss-selector-parser >= 6.1.0, < 6.1.3</code> <ins>CVE-2026-9358</ins> LOW</summary>

`npm-postcss-selector-parser >= 6.1.0, < 6.1.3` CODE_REPOSITORY/examples <ins>CVE-2026-9358</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/1090

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2026-9358
> - https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9
> - https://vuldb.com/submit/813080
> - https://vuldb.com/vuln/365321
> - https://vuldb.com/vuln/365321/cti
> - https://github.com/postcss/postcss-selector-parser/commit/5bc698cef66f8abd12610dc623e5d67cbc0f869d
> - https://github.com/postcss/postcss-selector-parser/commit/e37c5b0b785b165e27508d2489fdec8e0f18b10a
> - https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.3
> - https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.3
> - https://vuldb.com/cve/CVE-2026-9358
> - https://github.com/advisories/GHSA-w9m9-85wc-3x92
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 0.9.9, < 14.2.24</code> <ins>CVE-2025-32421</ins> LOW</summary>

`npm-next >= 0.9.9, < 14.2.24` CODE_REPOSITORY/examples <ins>CVE-2025-32421</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/267

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4
> - https://nvd.nist.gov/vuln/detail/CVE-2025-32421
> - https://vercel.com/changelog/cve-2025-32421
> - https://github.com/advisories/GHSA-qpjv-v59x-3qc4
> 
> </details>

</details>

<details><summary>FIXED <code>npm-@auth0/nextjs-auth0 >= 4.9.0, < 4.13.0</code> <ins>CVE-2025-67716</ins> LOW</summary>

`npm-@auth0/nextjs-auth0 >= 4.9.0, < 4.13.0` CODE_REPOSITORY/examples <ins>CVE-2025-67716</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/307

> <details><summary>Related URLs</summary>
> 
> - https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-mr6f-h57v-rpj5
> - https://github.com/auth0/nextjs-auth0/commit/35eb321de3345ccf23e8c0d6f66c9f2f2f57d26c
> - https://nvd.nist.gov/vuln/detail/CVE-2025-67716
> - https://github.com/advisories/GHSA-mr6f-h57v-rpj5
> 
> </details>

</details>

<details><summary>FIXED <code>npm-qs >= 6.7.0, <= 6.14.1</code> <ins>CVE-2026-2391</ins> LOW</summary>

`npm-qs >= 6.7.0, <= 6.14.1` CODE_REPOSITORY/examples <ins>CVE-2026-2391</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/379

> <details><summary>Related URLs</summary>
> 
> - https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883
> - https://nvd.nist.gov/vuln/detail/CVE-2026-2391
> - https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482
> - https://github.com/advisories/GHSA-w7fw-mjwx-w883
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 13.4.6, < 15.5.16</code> <ins>CVE-2026-44582</ins> LOW</summary>

`npm-next >= 13.4.6, < 15.5.16` CODE_REPOSITORY/examples <ins>CVE-2026-44582</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/744

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949
> - https://github.com/vercel/next.js/releases/tag/v15.5.16
> - https://github.com/vercel/next.js/releases/tag/v16.2.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-44582
> - https://github.com/advisories/GHSA-vfv6-92ff-j949
> 
> </details>

</details>

<details><summary>FIXED <code>npm-body-parser < 1.20.6</code> <ins>CVE-2026-12590</ins> LOW</summary>

`npm-body-parser < 1.20.6` CODE_REPOSITORY/examples <ins>CVE-2026-12590</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/956

> <details><summary>Related URLs</summary>
> 
> - https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6
> - https://nvd.nist.gov/vuln/detail/CVE-2026-12590
> - https://github.com/expressjs/body-parser/pull/698
> - https://github.com/expressjs/body-parser/pull/741
> - https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d
> - https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac
> - https://cna.openjsf.org/security-advisories.html
> - https://github.com/expressjs/body-parser/releases/tag/1.20.6
> - https://github.com/expressjs/body-parser/releases/tag/v2.3.0
> - https://github.com/advisories/GHSA-v422-hmwv-36x6
> 
> </details>

</details>

<details><summary>FIXED <code>npm-hono >= 4.7.0, < 4.12.34</code> <ins>CVE-2026-71849</ins> LOW</summary>

`npm-hono >= 4.7.0, < 4.12.34` CODE_REPOSITORY/examples <ins>CVE-2026-71849</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/1053

> <details><summary>Related URLs</summary>
> 
> - https://github.com/honojs/hono/security/advisories/GHSA-79qm-7rj5-m7r9
> - https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f
> - https://github.com/honojs/hono/releases/tag/v4.12.34
> - https://github.com/advisories/GHSA-79qm-7rj5-m7r9
> 
> </details>

</details>

<details><summary>FIXED <code>npm-@babel/core <= 7.29.0</code> <ins>CVE-2026-49356</ins> LOW</summary>

`npm-@babel/core <= 7.29.0` CODE_REPOSITORY/examples <ins>CVE-2026-49356</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/873

> <details><summary>Related URLs</summary>
> 
> - https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8
> - https://babeljs.io/docs/options#inputsourcemap
> - https://nvd.nist.gov/vuln/detail/CVE-2026-49356
> - https://github.com/advisories/GHSA-4x5r-pxfx-6jf8
> 
> </details>

</details>

<details><summary>FIXED <code>npm-brace-expansion >= 2.0.0, <= 2.0.1</code> <ins>CVE-2025-5889</ins> LOW</summary>

`npm-brace-expansion >= 2.0.0, <= 2.0.1` CODE_REPOSITORY/examples <ins>CVE-2025-5889</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/104

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2025-5889
> - https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5
> - https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466
> - https://vuldb.com/?ctiid.311660
> - https://vuldb.com/?id.311660
> - https://vuldb.com/?submit.585717
> - https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2
> - https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f
> - https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e
> - https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217
> - https://github.com/advisories/GHSA-v6h2-p8h4-qcjw
> 
> </details>

</details>

<details><summary>FIXED <code>npm-brace-expansion >= 1.0.0, <= 1.1.11</code> <ins>CVE-2025-5889</ins> LOW</summary>

`npm-brace-expansion >= 1.0.0, <= 1.1.11` CODE_REPOSITORY/examples <ins>CVE-2025-5889</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/167

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2025-5889
> - https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5
> - https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466
> - https://vuldb.com/?ctiid.311660
> - https://vuldb.com/?id.311660
> - https://vuldb.com/?submit.585717
> - https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2
> - https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f
> - https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e
> - https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217
> - https://github.com/advisories/GHSA-v6h2-p8h4-qcjw
> 
> </details>

</details>

<details><summary>FIXED <code>npm-esbuild >= 0.27.3, < 0.28.1</code> <ins>GHSA-g7r4-m6w7-qqqr</ins> LOW</summary>

`npm-esbuild >= 0.27.3, < 0.28.1` CODE_REPOSITORY/examples <ins>GHSA-g7r4-m6w7-qqqr</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/839

> <details><summary>Related URLs</summary>
> 
> - https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr
> - https://github.com/evanw/esbuild/releases/tag/v0.28.1
> - https://github.com/advisories/GHSA-g7r4-m6w7-qqqr
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 0.9.9, < 13.4.20-canary.13</code> <ins>CVE-2023-46298</ins> LOW</summary>

`npm-next >= 0.9.9, < 13.4.20-canary.13` CODE_REPOSITORY/examples <ins>CVE-2023-46298</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/27

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2023-46298
> - https://github.com/vercel/next.js/issues/45301
> - https://github.com/vercel/next.js/pull/54732
> - https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13
> - https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648
> - https://github.com/advisories/GHSA-c59h-r6p8-q9wc
> 
> </details>

</details>

<details><summary>FIXED <code>npm-es5-ext >= 0.10.0, < 0.10.63</code> <ins>CVE-2024-27088</ins> LOW</summary>

`npm-es5-ext >= 0.10.0, < 0.10.63` CODE_REPOSITORY/examples <ins>CVE-2024-27088</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/57

> <details><summary>Related URLs</summary>
> 
> - https://github.com/medikoo/es5-ext/security/advisories/GHSA-4gmj-3p3h-gm8h
> - https://nvd.nist.gov/vuln/detail/CVE-2024-27088
> - https://github.com/medikoo/es5-ext/issues/201
> - https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2
> - https://github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602
> - https://github.com/advisories/GHSA-4gmj-3p3h-gm8h
> 
> </details>

</details>

<details><summary>FIXED <code>npm-cookie < 0.7.0</code> <ins>CVE-2024-47764</ins> LOW</summary>

`npm-cookie < 0.7.0` CODE_REPOSITORY/examples <ins>CVE-2024-47764</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/205

> <details><summary>Related URLs</summary>
> 
> - https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x
> - https://github.com/jshttp/cookie/pull/167
> - https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c
> - https://github.com/advisories/GHSA-pxg6-pf52-xh8x
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 13.0, < 14.2.30</code> <ins>CVE-2025-48068</ins> LOW</summary>

`npm-next >= 13.0, < 14.2.30` CODE_REPOSITORY/examples <ins>CVE-2025-48068</ins> **LOW** remediate by: 2026-12-02T14:05:20.740Z
- https://github.com/commercelayer/examples/security/dependabot/110

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-3h52-269p-cp9r
> - https://vercel.com/changelog/cve-2025-48068
> - https://nvd.nist.gov/vuln/detail/CVE-2025-48068
> - https://github.com/advisories/GHSA-3h52-269p-cp9r
> 
> </details>

<details><summary>FIXED <code>npm-@humanfs/node < 0.16.8</code> <ins>GHSA-p498-v437-472g</ins> MEDIUM</summary>

`npm-@humanfs/node < 0.16.8` CODE_REPOSITORY/examples <ins>GHSA-p498-v437-472g</ins> **MEDIUM** remediate by: 2026-11-02T14:05:20.177Z
- https://github.com/commercelayer/examples/security/dependabot/1102

> <details><summary>Related URLs</summary>
> 
> - https://github.com/humanwhocodes/humanfs/security/advisories/GHSA-p498-v437-472g
> - https://github.com/humanwhocodes/humanfs/commit/22bbaa4487a3e6c1197ca619840de4615d0c3404
> - https://github.com/humanwhocodes/humanfs/releases/tag/node-v0.16.8
> - https://github.com/advisories/GHSA-p498-v437-472g
> 
> </details>

</details>

Navigation Menu

Uh oh!

[VANTA] [VULNERABILITY] <MEDIUM> CVE-2025-62718, CVE-2026-40175, CVE-2026-67312 and others, fix before 2026-11-02 #37

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

[VANTA] [VULNERABILITY] <MEDIUM> CVE-2025-62718, CVE-2026-40175, CVE-2026-67312 and others, fix before 2026-11-02 #37

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions