[VANTA] [VULNERABILITY] <HIGH> CVE-2026-33532, CVE-2026-33671, CVE-2026-33672 and others, fix before 2026-07-19

Important

CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.

DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

npm-picomatch < 2.3.2 CODE_REPOSITORY/mfe-identity CVE-2026-33671 HIGH remediate by: 2026-04-25T14:19:30.796Z

https://github.com/commercelayer/mfe-identity/security/dependabot/88

Related URLs

GHSA-c2c7-rcm5-vvqj

micromatch/picomatch@5eceecd

https://nvd.nist.gov/vuln/detail/CVE-2026-33671

GHSA-c2c7-rcm5-vvqj

npm-picomatch < 2.3.2 CODE_REPOSITORY/mfe-identity CVE-2026-33672 MEDIUM remediate by: 2026-05-25T14:19:31.055Z

https://github.com/commercelayer/mfe-identity/security/dependabot/89

Related URLs

GHSA-3v7f-55p6-f55p

micromatch/picomatch@4516eb5

https://nvd.nist.gov/vuln/detail/CVE-2026-33672

GHSA-3v7f-55p6-f55p

npm-yaml >= 2.0.0, < 2.8.3 CODE_REPOSITORY/mfe-identity CVE-2026-33532 MEDIUM remediate by: 2026-05-25T22:15:31.419Z

https://github.com/commercelayer/mfe-identity/security/dependabot/90

Related URLs

GHSA-48c2-rrv3-qjmp

eemeli/yaml@1e84ebb

https://github.com/eemeli/yaml/releases/tag/v1.10.3

https://github.com/eemeli/yaml/releases/tag/v2.8.3

https://nvd.nist.gov/vuln/detail/CVE-2026-33532

GHSA-48c2-rrv3-qjmp

npm-vite >= 7.0.0, <= 7.3.4 CODE_REPOSITORY/mfe-identity CVE-2026-53571 HIGH remediate by: 2026-07-19T20:00:53.324Z

https://github.com/commercelayer/mfe-identity/security/dependabot/133

Related URLs

GHSA-fx2h-pf6j-xcff

GHSA-fx2h-pf6j-xcff

npm-vite >= 7.0.0, <= 7.3.4 CODE_REPOSITORY/mfe-identity CVE-2026-53632 MEDIUM remediate by: 2026-08-19T11:55:15.837Z

https://github.com/commercelayer/mfe-identity/security/dependabot/134

Related URLs

GHSA-v6wh-96g9-6wx3

GHSA-v6wh-96g9-6wx3

npm-ws >= 8.0.0, < 8.21.0 CODE_REPOSITORY/mfe-identity CVE-2026-48779 HIGH remediate by: 2026-07-24T03:52:22.900Z

https://github.com/commercelayer/mfe-identity/security/dependabot/138

Related URLs

GHSA-96hv-2xvq-fx4p

websockets/ws@86d3e8a

websockets/ws@b5372ac

websockets/ws@bca91ad

websockets/ws@fd36cd8

GHSA-96hv-2xvq-fx4p

npm-ws >= 8.0.0, < 8.20.1 CODE_REPOSITORY/mfe-identity CVE-2026-45736 MEDIUM remediate by: 2026-07-28T19:58:27.074Z

https://github.com/commercelayer/mfe-identity/security/dependabot/122

Related URLs

GHSA-58qx-3vcg-4xpx

https://nvd.nist.gov/vuln/detail/CVE-2026-45736

websockets/ws@c0327ec

GHSA-58qx-3vcg-4xpx

npm-esbuild >= 0.27.3, < 0.28.1 CODE_REPOSITORY/mfe-identity GHSA-g7r4-m6w7-qqqr LOW remediate by: 2026-09-11T03:51:29.334Z

https://github.com/commercelayer/mfe-identity/security/dependabot/131

Related URLs

GHSA-g7r4-m6w7-qqqr

https://github.com/evanw/esbuild/releases/tag/v0.28.1

GHSA-g7r4-m6w7-qqqr

REPO TAG SKIPPED (no releases)

CODE_REPOSITORY/mfe-identity

All the listed vulnerabilities are still detected.
Please resolve within 16 days.

CODE_REPOSITORY/mfe-identity

All the listed vulnerabilities are still detected.
Please resolve within 10 days.

CODE_REPOSITORY/mfe-identity

All the listed vulnerabilities are still detected.
Please resolve within 7 days.

CODE_REPOSITORY/mfe-identity

All the listed vulnerabilities are still detected.
Please resolve within 6 days.

Navigation Menu

Repository navigation

[VANTA] [VULNERABILITY] <HIGH> CVE-2026-33532, CVE-2026-33671, CVE-2026-33672 and others, fix before 2026-07-19 #67

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[VANTA] [VULNERABILITY] <HIGH> CVE-2026-33532, CVE-2026-33671, CVE-2026-33672 and others, fix before 2026-07-19 #67

Description

Activity

commercelayer-ci commented on Jul 3, 2026

commercelayer-ci commented on Jul 9, 2026

commercelayer-ci commented on Jul 12, 2026

commercelayer-ci commented on Jul 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions