Security Score
92/100 · up 4 this month
Critical
0
Critical severity findings
High
0
High severity findings
Medium
0
Medium severity findings
Low
0
Low severity findings
Vulnerabilities
8 findings
| Package | Severity | CVE | Current | Fixed | Risk | Action |
|---|---|---|---|---|---|---|
| lodash | critical | CVE-2026-31844 | 4.17.20 | 4.17.21 | Reachable from 3 production services | |
| openssl | critical | CVE-2026-2908 | 3.0.8 | 3.0.13 | TLS termination on API Gateway | |
| jsonwebtoken | critical | CVE-2026-11207 | 8.5.1 | 9.0.2 | Token verification bypass path | |
| axios | high | CVE-2026-45142 | 1.4.0 | 1.7.4 | SSRF via redirect handling | |
| postgres | high | CVE-2026-1094 | 3.3.4 | 3.4.5 | Connection pool memory leak | |
| vite | medium | CVE-2026-31125 | 5.1.0 | 5.4.6 | Dev server path traversal | |
| tar | medium | CVE-2026-28863 | 6.1.11 | 6.2.1 | Build-time archive handling | |
| semver | low | CVE-2026-25883 | 7.5.0 | 7.5.2 | Regex denial of service |
- lodashcritical
CVE-2026-31844 · 4.17.20 → 4.17.21
Bump to 4.17.21 — no breaking API changes across the 14 call sites detected.
- opensslcritical
CVE-2026-2908 · 3.0.8 → 3.0.13
Rebuild the payments-api base image; pipeline cache will handle the rest.
- jsonwebtokencritical
CVE-2026-11207 · 8.5.1 → 9.0.2
Upgrade and switch to explicit algorithm allow-listing in auth-service.
- axioshigh
CVE-2026-45142 · 1.4.0 → 1.7.4
Safe minor upgrade; 2 mocked tests need updated interceptor signatures.
- postgreshigh
CVE-2026-1094 · 3.3.4 → 3.4.5
Correlated with the payments-api pool exhaustion seen during INC-2048.
- vitemedium
CVE-2026-31125 · 5.1.0 → 5.4.6
Development-only exposure; batch with the next frontend dependency sweep.
- tarmedium
CVE-2026-28863 · 6.1.11 → 6.2.1
Included in the next data-pipeline image rebuild.
- semverlow
CVE-2026-25883 · 7.5.0 → 7.5.2
No untrusted input reaches this parser. Track only.
CVE-2026-31844
4.17.20 → 4.17.21
Bump to 4.17.21 — no breaking API changes across the 14 call sites detected.
CVE-2026-2908
3.0.8 → 3.0.13
Rebuild the payments-api base image; pipeline cache will handle the rest.
CVE-2026-11207
8.5.1 → 9.0.2
Upgrade and switch to explicit algorithm allow-listing in auth-service.