Vulnerable Library - vue-3.5.20.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (vue version) |
Remediation Possible** |
| CVE-2026-73646 |
 High |
7.5 |
postcss-8.5.6.tgz |
Transitive |
N/A* |
❌ |
| CVE-2026-45623 |
High |
7.5 |
postcss-8.5.6.tgz |
Transitive |
3.5.21 |
❌ |
| CVE-2026-73086 |
High |
7.4 |
nanoid-3.3.11.tgz |
Transitive |
3.5.21 |
❌ |
| CVE-2026-41305 |
 Medium |
6.1 |
postcss-8.5.6.tgz |
Transitive |
3.5.21 |
❌ |
| CVE-2026-67214 |
Medium |
5.9 |
nanoid-3.3.11.tgz |
Transitive |
3.5.36 |
❌ |
| CVE-2026-67213 |
Medium |
5.9 |
nanoid-3.3.11.tgz |
Transitive |
3.5.36 |
❌ |
| CVE-2026-69153 |
Medium |
5.3 |
postcss-8.5.6.tgz |
Transitive |
N/A* |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-73646
Vulnerable Library - postcss-8.5.6.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- vue-3.5.20.tgz (Root Library)
- compiler-sfc-3.5.20.tgz
- ❌ postcss-8.5.6.tgz (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
Vulnerability Details File: "lib/previous-map.js" Line: 87-98 ("loadFile"), 129-144 ("loadMap") Root Cause PostCSS auto-detects a "/*# sourceMappingURL=... /" comment inside the CSS text it is asked to parse and, unless the caller explicitly passes "map: false", attempts to load that path from disk as a "previous source map." This happens on every "postcss.parse()" / "postcss().process()" call by default (opt-out, not opt-in). "loadMap()" builds the candidate path via "join(dirname(opts.from), annotation)", where "annotation" is the raw, attacker-controlled string from the CSS comment. "path.join()" normalizes but does not sandbox ".." segments, so a "../../../" prefix walks the resolved path outside the intended directory. If "opts.from" is not set at all, the annotation is used completely unmodified — an absolute path in the CSS comment is read verbatim. 8.5.12 already fixed a strictly worse variant of this (any file, any extension, could be read) by requiring the resolved path to end in ".map" ("loadFile()"). That fix did not address the traversal itself, only the target extension. Since the "join(dirname(file), map)" logic has existed unchanged since PostCSS 8.0.0 (Feb 2020), any file ending in ".map" remains readable through this path in the current release (8.5.16). Once loaded, "MapGenerator.isMap()" treats the mere presence of a loaded "previous map" as an implicit request to generate "result.map", even when the caller never set the "map" option. If the loaded map has a "sourcesContent" field (common for maps emitted by bundlers/transpilers), that content is merged into "result.map" and returned to the caller — disclosing the traversed-to file's content to whoever supplied the CSS. Attack Scenario 1. A service accepts user-submitted CSS and runs it through PostCSS to lint/format/transform it, e.g. "postcss().process(userCss, { from: '/app/uploads/user123/input.css', to: '/app/uploads/user123/output.css' })" — idiomatic usage; "map" option untouched. 2. Attacker submits CSS containing "/# sourceMappingURL=../../../../some/other/app/dist/bundle.js.map */" (or an absolute path if "from" is unset). 3. PostCSS reads that ".map" file and folds its "sourcesContent" into "result.map". 4. The service does what most build pipelines do with a truthy "result.map" — writes it next to the CSS output or returns it via API (source maps are meant to be consumed by browser devtools, so this is commonly public/served). 5. Attacker retrieves the emitted map and reads out the traversed file's content. Impact Disclosure of the contents of arbitrary ".map" files reachable via path traversal (or absolute path when "from" is unset) from the process's filesystem. Affects any application processing CSS it does not fully trust without explicitly passing "map: false". No authentication or user interaction beyond submitting CSS text is required. Vulnerable Code loadFile(path, cssFile, trusted) { if (!trusted && !this.unsafeMap) { if (!/.map$/i.test(path)) { return undefined } } this.root = dirname(path) if (existsSync(path)) { this.mapFile = path return readFileSync(path, 'utf-8').toString().trim() } } loadMap(file, prev) { ... } else if (this.annotation) { let map = this.annotation if (file) map = join(dirname(file), map) let unknown = this.loadFile(map, file, false) ... } } Recommended Fix Constrain the resolved path to remain inside the CSS file's own directory instead of relying solely on a filename-extension check: loadFile(path, cssFile, trusted) { if (!trusted && !this.unsafeMap) { if (!/.map$/i.test(path)) { return undefined } if (!cssFile) return undefined let root = resolve(dirname(cssFile)) let resolvedPath = resolve(root, path) if (resolvedPath !== root && !resolvedPath.startsWith(root + sep)) { return undefined } } this.root = dirname(path) if (existsSync(path)) { this.mapFile = path return readFileSync(path, 'utf-8').toString().trim() } } I've implemented, tested (full existing test suite — 660/660 passing, plus new PoC-based regression checks for both the traversal and legitimate same-directory cases), and can share this fix on request or via a private fork if invited. Verification Dynamically confirmed on v8.5.16 (current npm release / repo HEAD) via a standalone Node.js harness against "lib/postcss.js": a "secret" ".map" file placed two directories outside a simulated project directory was read via a crafted "sourceMappingURL" comment in otherwise-innocuous CSS, with its "sourcesContent" appearing verbatim in "result.map.toString()" — with no "map" option set by the caller. A second harness confirmed the simpler no-"from" case reads an absolute path directly. A third harness confirmed "map: false" is the only current workaround. The attached fix branch closes both vectors while keeping all 660 existing unit tests green.
Publish Date: 2026-08-13
URL: CVE-2026-73646
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-r28c-9q8g-f849
Release Date: 2026-08-13
Fix Resolution: postcss - 8.5.18
Step up your Open Source Security Game with Mend here
CVE-2026-45623
Vulnerable Library - postcss-8.5.6.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- vue-3.5.20.tgz (Root Library)
- compiler-sfc-3.5.20.tgz
- ❌ postcss-8.5.6.tgz (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.
Publish Date: 2026-07-27
URL: CVE-2026-45623
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-23
Fix Resolution (postcss): 8.5.12
Direct dependency fix Resolution (vue): 3.5.21
Step up your Open Source Security Game with Mend here
CVE-2026-73086
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- vue-3.5.20.tgz (Root Library)
- compiler-sfc-3.5.20.tgz
- postcss-8.5.6.tgz
- ❌ nanoid-3.3.11.tgz (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
Publish Date: 2026-08-11
URL: CVE-2026-73086
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-xwg4-73v4-xw9w
Release Date: 2026-08-11
Fix Resolution (nanoid): 3.3.12
Direct dependency fix Resolution (vue): 3.5.21
Step up your Open Source Security Game with Mend here
CVE-2026-41305
Vulnerable Library - postcss-8.5.6.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- vue-3.5.20.tgz (Root Library)
- compiler-sfc-3.5.20.tgz
- ❌ postcss-8.5.6.tgz (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape "</style>" sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML "<style>" tags, "</style>" in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Publish Date: 2026-04-24
URL: CVE-2026-41305
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qx2v-qp2m-jg93
Release Date: 2026-04-24
Fix Resolution (postcss): 8.5.10
Direct dependency fix Resolution (vue): 3.5.21
Step up your Open Source Security Game with Mend here
CVE-2026-67214
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- vue-3.5.20.tgz (Root Library)
- compiler-sfc-3.5.20.tgz
- postcss-8.5.6.tgz
- ❌ nanoid-3.3.11.tgz (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Publish Date: 2026-07-29
URL: CVE-2026-67214
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-29
Fix Resolution (nanoid): 5.1.16
Direct dependency fix Resolution (vue): 3.5.36
Step up your Open Source Security Game with Mend here
CVE-2026-67213
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- vue-3.5.20.tgz (Root Library)
- compiler-sfc-3.5.20.tgz
- postcss-8.5.6.tgz
- ❌ nanoid-3.3.11.tgz (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
Publish Date: 2026-07-29
URL: CVE-2026-67213
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-29
Fix Resolution (nanoid): 5.1.6
Direct dependency fix Resolution (vue): 3.5.36
Step up your Open Source Security Game with Mend here
CVE-2026-69153
Vulnerable Library - postcss-8.5.6.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
- vue-3.5.20.tgz (Root Library)
- compiler-sfc-3.5.20.tgz
- ❌ postcss-8.5.6.tgz (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Publish Date: 2026-08-03
URL: CVE-2026-69153
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-03
Fix Resolution: https://github.com/postcss/postcss.git - 8.5.23
Step up your Open Source Security Game with Mend here
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - postcss-8.5.6.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in base branch: develop
Vulnerability Details
Vulnerability Details File: "lib/previous-map.js" Line: 87-98 ("loadFile"), 129-144 ("loadMap") Root Cause PostCSS auto-detects a "/*# sourceMappingURL=... /" comment inside the CSS text it is asked to parse and, unless the caller explicitly passes "map: false", attempts to load that path from disk as a "previous source map." This happens on every "postcss.parse()" / "postcss().process()" call by default (opt-out, not opt-in). "loadMap()" builds the candidate path via "join(dirname(opts.from), annotation)", where "annotation" is the raw, attacker-controlled string from the CSS comment. "path.join()" normalizes but does not sandbox ".." segments, so a "../../../" prefix walks the resolved path outside the intended directory. If "opts.from" is not set at all, the annotation is used completely unmodified — an absolute path in the CSS comment is read verbatim. 8.5.12 already fixed a strictly worse variant of this (any file, any extension, could be read) by requiring the resolved path to end in ".map" ("loadFile()"). That fix did not address the traversal itself, only the target extension. Since the "join(dirname(file), map)" logic has existed unchanged since PostCSS 8.0.0 (Feb 2020), any file ending in ".map" remains readable through this path in the current release (8.5.16). Once loaded, "MapGenerator.isMap()" treats the mere presence of a loaded "previous map" as an implicit request to generate "result.map", even when the caller never set the "map" option. If the loaded map has a "sourcesContent" field (common for maps emitted by bundlers/transpilers), that content is merged into "result.map" and returned to the caller — disclosing the traversed-to file's content to whoever supplied the CSS. Attack Scenario 1. A service accepts user-submitted CSS and runs it through PostCSS to lint/format/transform it, e.g. "postcss().process(userCss, { from: '/app/uploads/user123/input.css', to: '/app/uploads/user123/output.css' })" — idiomatic usage; "map" option untouched. 2. Attacker submits CSS containing "/# sourceMappingURL=../../../../some/other/app/dist/bundle.js.map */" (or an absolute path if "from" is unset). 3. PostCSS reads that ".map" file and folds its "sourcesContent" into "result.map". 4. The service does what most build pipelines do with a truthy "result.map" — writes it next to the CSS output or returns it via API (source maps are meant to be consumed by browser devtools, so this is commonly public/served). 5. Attacker retrieves the emitted map and reads out the traversed file's content. Impact Disclosure of the contents of arbitrary ".map" files reachable via path traversal (or absolute path when "from" is unset) from the process's filesystem. Affects any application processing CSS it does not fully trust without explicitly passing "map: false". No authentication or user interaction beyond submitting CSS text is required. Vulnerable Code loadFile(path, cssFile, trusted) { if (!trusted && !this.unsafeMap) { if (!/.map$/i.test(path)) { return undefined } } this.root = dirname(path) if (existsSync(path)) { this.mapFile = path return readFileSync(path, 'utf-8').toString().trim() } } loadMap(file, prev) { ... } else if (this.annotation) { let map = this.annotation if (file) map = join(dirname(file), map) let unknown = this.loadFile(map, file, false) ... } } Recommended Fix Constrain the resolved path to remain inside the CSS file's own directory instead of relying solely on a filename-extension check: loadFile(path, cssFile, trusted) { if (!trusted && !this.unsafeMap) { if (!/.map$/i.test(path)) { return undefined } if (!cssFile) return undefined let root = resolve(dirname(cssFile)) let resolvedPath = resolve(root, path) if (resolvedPath !== root && !resolvedPath.startsWith(root + sep)) { return undefined } } this.root = dirname(path) if (existsSync(path)) { this.mapFile = path return readFileSync(path, 'utf-8').toString().trim() } } I've implemented, tested (full existing test suite — 660/660 passing, plus new PoC-based regression checks for both the traversal and legitimate same-directory cases), and can share this fix on request or via a private fork if invited. Verification Dynamically confirmed on v8.5.16 (current npm release / repo HEAD) via a standalone Node.js harness against "lib/postcss.js": a "secret" ".map" file placed two directories outside a simulated project directory was read via a crafted "sourceMappingURL" comment in otherwise-innocuous CSS, with its "sourcesContent" appearing verbatim in "result.map.toString()" — with no "map" option set by the caller. A second harness confirmed the simpler no-"from" case reads an absolute path directly. A third harness confirmed "map: false" is the only current workaround. The attached fix branch closes both vectors while keeping all 660 existing unit tests green.
Publish Date: 2026-08-13
URL: CVE-2026-73646
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-r28c-9q8g-f849
Release Date: 2026-08-13
Fix Resolution: postcss - 8.5.18
Step up your Open Source Security Game with Mend here
Vulnerable Library - postcss-8.5.6.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in base branch: develop
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.
Publish Date: 2026-07-27
URL: CVE-2026-45623
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-23
Fix Resolution (postcss): 8.5.12
Direct dependency fix Resolution (vue): 3.5.21
Step up your Open Source Security Game with Mend here
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in base branch: develop
Vulnerability Details
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
Publish Date: 2026-08-11
URL: CVE-2026-73086
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-xwg4-73v4-xw9w
Release Date: 2026-08-11
Fix Resolution (nanoid): 3.3.12
Direct dependency fix Resolution (vue): 3.5.21
Step up your Open Source Security Game with Mend here
Vulnerable Library - postcss-8.5.6.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in base branch: develop
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape "</style>" sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML "<style>" tags, "</style>" in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Publish Date: 2026-04-24
URL: CVE-2026-41305
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-qx2v-qp2m-jg93
Release Date: 2026-04-24
Fix Resolution (postcss): 8.5.10
Direct dependency fix Resolution (vue): 3.5.21
Step up your Open Source Security Game with Mend here
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in base branch: develop
Vulnerability Details
nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Publish Date: 2026-07-29
URL: CVE-2026-67214
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-29
Fix Resolution (nanoid): 5.1.16
Direct dependency fix Resolution (vue): 3.5.36
Step up your Open Source Security Game with Mend here
Vulnerable Library - nanoid-3.3.11.tgz
A tiny (116 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in base branch: develop
Vulnerability Details
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
Publish Date: 2026-07-29
URL: CVE-2026-67213
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-29
Fix Resolution (nanoid): 5.1.6
Direct dependency fix Resolution (vue): 3.5.36
Step up your Open Source Security Game with Mend here
Vulnerable Library - postcss-8.5.6.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz
Sample Path to Dependency File: /apps/package.json
Path to vulnerable library: /apps/package.json
Dependency Hierarchy:
Found in base branch: develop
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Publish Date: 2026-08-03
URL: CVE-2026-69153
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-03
Fix Resolution: https://github.com/postcss/postcss.git - 8.5.23
Step up your Open Source Security Game with Mend here