[VANTA] [VULNERABILITY] <HIGH> CVE-2026-27977, CVE-2026-27978, CVE-2026-27979 and others, fix before 2026-04-25

> [!IMPORTANT]
> CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.
>
> DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

<details><summary>FIXED <code>npm-picomatch >= 4.0.0, < 4.0.4</code> <ins>CVE-2026-33671</ins> HIGH</summary>

`npm-picomatch >= 4.0.0, < 4.0.4` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-33671</ins> **HIGH** remediate by: 2026-04-25T14:19:30.796Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/248

> <details><summary>Related URLs</summary>
> 
> - https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj
> - https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d
> - https://nvd.nist.gov/vuln/detail/CVE-2026-33671
> - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
> 
> </details>

</details>

<details><summary>FIXED <code>npm-picomatch >= 4.0.0, < 4.0.4</code> <ins>CVE-2026-33672</ins> MEDIUM</summary>

`npm-picomatch >= 4.0.0, < 4.0.4` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-33672</ins> **MEDIUM** remediate by: 2026-05-25T14:19:31.055Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/243

> <details><summary>Related URLs</summary>
> 
> - https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p
> - https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903
> - https://nvd.nist.gov/vuln/detail/CVE-2026-33672
> - https://github.com/advisories/GHSA-3v7f-55p6-f55p
> 
> </details>

</details>

<details><summary>FIXED <code>npm-picomatch < 2.3.2</code> <ins>CVE-2026-33671</ins> HIGH</summary>

`npm-picomatch < 2.3.2` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-33671</ins> **HIGH** remediate by: 2026-04-29T22:15:21.750Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/240

> <details><summary>Related URLs</summary>
> 
> - https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj
> - https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d
> - https://nvd.nist.gov/vuln/detail/CVE-2026-33671
> - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
> 
> </details>

</details>

<details><summary>FIXED <code>npm-picomatch < 2.3.2</code> <ins>CVE-2026-33672</ins> MEDIUM</summary>

`npm-picomatch < 2.3.2` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-33672</ins> **MEDIUM** remediate by: 2026-05-29T22:15:22.072Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/239

> <details><summary>Related URLs</summary>
> 
> - https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p
> - https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903
> - https://nvd.nist.gov/vuln/detail/CVE-2026-33672
> - https://github.com/advisories/GHSA-3v7f-55p6-f55p
> 
> </details>

</details>

<details><summary>FIXED <code>npm-h3 < 1.15.6</code> <ins>CVE-2026-33128</ins> HIGH</summary>

`npm-h3 < 1.15.6` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-33128</ins> **HIGH** remediate by: 2026-04-29T22:15:21.750Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/234

> <details><summary>Related URLs</summary>
> 
> - https://github.com/h3js/h3/security/advisories/GHSA-22cc-p3c6-wpvm
> - https://github.com/h3js/h3/commit/7791538e15ca22437307c06b78fa155bb73632a6
> - https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187
> - https://nvd.nist.gov/vuln/detail/CVE-2026-33128
> - https://github.com/advisories/GHSA-22cc-p3c6-wpvm
> 
> </details>

</details>

<details><summary>FIXED <code>npm-h3 < 1.15.6</code> <ins>GHSA-wr4h-v87w-p3r7</ins> MEDIUM</summary>

`npm-h3 < 1.15.6` CODE_REPOSITORY/commercelayer-js-auth <ins>GHSA-wr4h-v87w-p3r7</ins> **MEDIUM** remediate by: 2026-05-29T22:15:22.072Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/233

> <details><summary>Related URLs</summary>
> 
> - https://github.com/h3js/h3/security/advisories/GHSA-wr4h-v87w-p3r7
> - https://github.com/h3js/h3/commit/0e751b4059060f2ade01a0bdfd96b0f5ffc8a26d
> - https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/static.ts#L86
> - https://github.com/advisories/GHSA-wr4h-v87w-p3r7
> 
> </details>

</details>

<details><summary>FIXED <code>npm-defu <= 6.1.4</code> <ins>CVE-2026-35209</ins> HIGH</summary>

`npm-defu <= 6.1.4` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-35209</ins> **HIGH** remediate by: 2026-05-04T14:17:32.574Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/262

> <details><summary>Related URLs</summary>
> 
> - https://github.com/unjs/defu/security/advisories/GHSA-737v-mqg7-c878
> - https://nvd.nist.gov/vuln/detail/CVE-2026-35209
> - https://github.com/unjs/defu/pull/156
> - https://github.com/unjs/defu/commit/3942bfbbcaa72084bd4284846c83bd61ed7c8b29
> - https://github.com/unjs/defu/releases/tag/v6.1.5
> - https://github.com/advisories/GHSA-737v-mqg7-c878
> 
> </details>

</details>

<details><summary>FIXED <code>npm-vite >= 7.0.0, <= 7.3.1</code> <ins>CVE-2026-39363</ins> HIGH</summary>

`npm-vite >= 7.0.0, <= 7.3.1` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-39363</ins> **HIGH** remediate by: 2026-05-07T06:20:48.749Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/272

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583
> - https://github.com/vitejs/vite/pull/22159
> - https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0
> - https://github.com/vitejs/vite/releases/tag/v6.4.2
> - https://github.com/vitejs/vite/releases/tag/v7.3.2
> - https://github.com/vitejs/vite/releases/tag/v8.0.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-39363
> - https://github.com/advisories/GHSA-p9ff-h696-f583
> 
> </details>

</details>

<details><summary>FIXED <code>npm-vite >= 7.0.0, <= 7.3.1</code> <ins>CVE-2026-39365</ins> MEDIUM</summary>

`npm-vite >= 7.0.0, <= 7.3.1` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-39365</ins> **MEDIUM** remediate by: 2026-06-06T14:36:41.686Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/277

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9
> - https://github.com/vitejs/vite/pull/22161
> - https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694
> - https://github.com/vitejs/vite/releases/tag/v6.4.2
> - https://github.com/vitejs/vite/releases/tag/v7.3.2
> - https://github.com/vitejs/vite/releases/tag/v8.0.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-39365
> - https://github.com/advisories/GHSA-4w7w-66w2-5vf9
> 
> </details>

</details>

<details><summary>FIXED <code>npm-vite >= 7.1.0, <= 7.3.1</code> <ins>CVE-2026-39364</ins> HIGH</summary>

`npm-vite >= 7.1.0, <= 7.3.1` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-39364</ins> **HIGH** remediate by: 2026-05-07T14:36:41.372Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/267

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r
> - https://github.com/vitejs/vite/pull/22160
> - https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff
> - https://github.com/vitejs/vite/releases/tag/v7.3.2
> - https://github.com/vitejs/vite/releases/tag/v8.0.5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-39364
> - https://github.com/advisories/GHSA-v2wj-q39q-566r
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 16.0.0-beta.0, < 16.2.3</code> <ins>GHSA-q4gf-8mx6-v5v3</ins> HIGH</summary>

`npm-next >= 16.0.0-beta.0, < 16.2.3` CODE_REPOSITORY/commercelayer-js-auth <ins>GHSA-q4gf-8mx6-v5v3</ins> **HIGH** remediate by: 2026-05-11T06:21:49.843Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/280

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-q4gf-8mx6-v5v3
> - https://vercel.com/changelog/summary-of-cve-2026-23869
> - https://github.com/advisories/GHSA-q4gf-8mx6-v5v3
> 
> </details>

</details>

<details><summary>FIXED <code>npm-h3 <= 1.15.8</code> <ins>GHSA-72gr-qfp7-vwhw</ins> MEDIUM</summary>

`npm-h3 <= 1.15.8` CODE_REPOSITORY/commercelayer-js-auth <ins>GHSA-72gr-qfp7-vwhw</ins> **MEDIUM** remediate by: 2026-05-29T22:15:22.072Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/237

> <details><summary>Related URLs</summary>
> 
> - https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw
> - https://github.com/advisories/GHSA-72gr-qfp7-vwhw
> 
> </details>

</details>

<details><summary>FIXED <code>npm-h3 < 1.15.9</code> <ins>GHSA-4hxc-9384-m385</ins> MEDIUM</summary>

`npm-h3 < 1.15.9` CODE_REPOSITORY/commercelayer-js-auth <ins>GHSA-4hxc-9384-m385</ins> **MEDIUM** remediate by: 2026-05-29T22:15:22.072Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/238

> <details><summary>Related URLs</summary>
> 
> - https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385
> - https://github.com/advisories/GHSA-4hxc-9384-m385
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 16.0.0-beta.0, < 16.1.7</code> <ins>CVE-2026-27980</ins> MEDIUM</summary>

`npm-next >= 16.0.0-beta.0, < 16.1.7` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-27980</ins> **MEDIUM** remediate by: 2026-05-29T22:15:22.072Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/236

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8
> - https://github.com/vercel/next.js/commit/39eb8e0ac498b48855a0430fbf4c22276a73b4bd
> - https://github.com/vercel/next.js/releases/tag/v16.1.7
> - https://nvd.nist.gov/vuln/detail/CVE-2026-27980
> - https://github.com/advisories/GHSA-3x4c-7xq6-9pq8
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 16.0.0-beta.0, < 16.1.7</code> <ins>CVE-2026-29057</ins> MEDIUM</summary>

`npm-next >= 16.0.0-beta.0, < 16.1.7` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-29057</ins> **MEDIUM** remediate by: 2026-05-29T22:15:22.072Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/232

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8
> - https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6
> - https://github.com/vercel/next.js/releases/tag/v15.5.13
> - https://github.com/vercel/next.js/releases/tag/v16.1.7
> - https://nvd.nist.gov/vuln/detail/CVE-2026-29057
> - https://github.com/advisories/GHSA-ggv3-7p47-pfv8
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 16.0.1, < 16.1.7</code> <ins>CVE-2026-27978</ins> MEDIUM</summary>

`npm-next >= 16.0.1, < 16.1.7` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-27978</ins> **MEDIUM** remediate by: 2026-05-29T22:15:22.072Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/228

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-mq59-m269-xvcx
> - https://github.com/vercel/next.js/commit/a27a11d78e748a8c7ccfd14b7759ad2b9bf097d8
> - https://github.com/vercel/next.js/releases/tag/v16.1.7
> - https://nvd.nist.gov/vuln/detail/CVE-2026-27978
> - https://github.com/advisories/GHSA-mq59-m269-xvcx
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 16.0.1, < 16.1.7</code> <ins>CVE-2026-27979</ins> MEDIUM</summary>

`npm-next >= 16.0.1, < 16.1.7` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-27979</ins> **MEDIUM** remediate by: 2026-05-29T22:15:22.072Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/230

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-h27x-g6w4-24gq
> - https://github.com/vercel/next.js/commit/c885d4825f800dd1e49ead37274dcd08cdd6f3f1
> - https://github.com/vercel/next.js/releases/tag/v16.1.7
> - https://nvd.nist.gov/vuln/detail/CVE-2026-27979
> - https://github.com/advisories/GHSA-h27x-g6w4-24gq
> 
> </details>

</details>

<details><summary>FIXED <code>npm-next >= 16.0.1, < 16.1.7</code> <ins>CVE-2026-27977</ins> LOW</summary>

`npm-next >= 16.0.1, < 16.1.7` CODE_REPOSITORY/commercelayer-js-auth <ins>CVE-2026-27977</ins> **LOW** remediate by: 2026-06-28T22:15:22.360Z
- https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/226

> <details><summary>Related URLs</summary>
> 
> - https://github.com/vercel/next.js/security/advisories/GHSA-jcc7-9wpm-mj36
> - https://github.com/vercel/next.js/commit/862f9b9bb41d235e0d8cf44aa811e7fd118cee2a
> - https://github.com/vercel/next.js/releases/tag/v16.1.7
> - https://nvd.nist.gov/vuln/detail/CVE-2026-27977
> - https://github.com/advisories/GHSA-jcc7-9wpm-mj36
> 
> </details>

</details>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[VANTA] [VULNERABILITY] <HIGH> CVE-2026-27977, CVE-2026-27978, CVE-2026-27979 and others, fix before 2026-04-25 #129

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

[VANTA] [VULNERABILITY] <HIGH> CVE-2026-27977, CVE-2026-27978, CVE-2026-27979 and others, fix before 2026-04-25 #129

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions