CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
No dependency in this snapshot currently appears in CISA's Known Exploited Vulnerabilities catalog. Today, nothing would trigger the 24-hour early-warning obligation of CRA Art. 14. That can change any day a new KEV entry lands, which is exactly what continuous monitoring is for.
⚠ No lockfile — SBOM is not reproducible
This scan is based on a manifest (package.json), not a lockfile. 25 of 35 dependencies are version ranges, so the exact shipped versions — and their transitive dependencies — cannot be verified. Under the CRA's full obligations (11 December 2027) you must produce a machine-readable SBOM of what you actually ship. Committing a lockfile is the single highest-impact fix in this report.
All findings (23)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| lodash | ^4.18.1 | CVE-2021-23337 | HIGH | 21.3% | 4.17.21 | Command Injection in lodash |
| moment dev | ^2.29.4 | CVE-2022-24785 | HIGH | 13.9% | 2.29.2 | Path Traversal: 'dir/../../filename' in moment.locale |
| moment dev | ^2.29.4 | CVE-2016-4055 | MODERATE | 9.9% | 2.11.2 | Regular Expression Denial of Service in moment |
| lodash | ^4.18.1 | CVE-2020-28500 | MODERATE | 7.3% | 4.17.21 | Regular Expression Denial of Service (ReDoS) in lodash |
| moment dev | ^2.29.4 | CVE-2022-31129 | HIGH | 5.6% | 2.29.4 | Moment.js vulnerable to Inefficient Regular Expression Complexity |
| lodash | ^4.18.1 | CVE-2020-8203 | HIGH | 5.2% | 4.17.19 | Prototype Pollution in lodash |
| lodash | ^4.18.1 | CVE-2019-10744 | CRITICAL | 5.0% | 4.17.12 | Prototype Pollution in lodash |
| moment dev | ^2.29.4 | CVE-2017-18214 | HIGH | 3.6% | 2.19.3 | Regular Expression Denial of Service in moment |
| glob dev | ^10.3.10 | CVE-2025-64756 | HIGH | 3.1% | 11.1.0 | glob CLI: Command injection via -c/--cmd executes matches with shell:true |
| lodash | ^4.18.1 | CVE-2019-1010266 | MODERATE | 3.0% | 4.17.11 | Regular Expression Denial of Service (ReDoS) in lodash |
| lodash | ^4.18.1 | CVE-2026-4800 | HIGH | 2.6% | 4.18.0 | lodash vulnerable to Code Injection via `_.template` imports key names |
| lodash | ^4.18.1 | CVE-2018-3721 | MODERATE | 2.3% | 4.17.5 | Prototype Pollution in lodash |
| lodash | ^4.18.1 | CVE-2025-13465 | MODERATE | 1.8% | 4.17.23 | Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions |
| lodash | ^4.18.1 | CVE-2018-16487 | HIGH | 1.5% | 4.17.11 | Prototype Pollution in lodash |
| webpack dev | catalog:tooling | CVE-2023-28154 | CRITICAL | 1.4% | 5.76.0 | Cross-realm object access in Webpack 5 |
| webpack dev | catalog:tooling | CVE-2024-43788 | MODERATE | 1.0% | 5.94.0 | Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS |
| @babel/runtime dev | catalog:tooling | CVE-2025-27789 | MODERATE | 0.6% | 7.26.10 | Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups |
| lodash | ^4.18.1 | CVE-2026-2950 | MODERATE | 0.4% | 4.18.0 | lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` |
| moment dev | ^2.29.4 | CVE-2026-17495 | MODERATE | 0.4% | 2.31.0 | moment vulnerable to Path Traversal via crafted non-string locale name |
| webpack dev | catalog:tooling | CVE-2025-68157 | LOW | 0.2% | 5.104.0 | webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence |
| webpack dev | catalog:tooling | CVE-2025-68458 | LOW | 0.2% | 5.104.1 | webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior |
| @babel/core | catalog:tooling | CVE-2026-49356 | LOW | 0.2% | 8.0.0-rc.6 | @babel/core: Arbitrary File Read via sourceMappingURL Comment |
| chalk dev | ^4.1.2 | MAL-2025-46969 | UNKNOWN | — | — | Malicious code in chalk (npm) |
SBOM summary
35 direct dependencies scanned (10 pinned to exact versions) from package.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.