CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
No dependency in this snapshot currently appears in CISA's Known Exploited Vulnerabilities catalog. Today, nothing would trigger the 24-hour early-warning obligation of CRA Art. 14. That can change any day a new KEV entry lands, which is exactly what continuous monitoring is for.
All findings (303)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| lodash-es dev | 4.17.21 | CVE-2021-23337 | HIGH | 21.3% | 4.18.0 | lodash vulnerable to Code Injection via `_.template` imports key names |
| lodash-es dev | 4.17.21 | CVE-2025-13465 | MODERATE | 1.8% | 4.18.0 | lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` |
| lodash-es dev | 4.17.21 | CVE-2025-13465 | MODERATE | 1.8% | 4.17.23 | Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions |
| axios | 1.13.2 | CVE-2026-25639 | HIGH | 1.8% | 1.13.5 | Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig |
| handlebars dev | 4.7.8 | CVE-2026-33937 | CRITICAL | 1.7% | 4.7.9 | Handlebars.js has JavaScript Injection via AST Type Confusion |
| immutable dev | 5.1.4 | CVE-2026-29063 | HIGH | 1.6% | 4.3.8 | Immutable is vulnerable to Prototype Pollution |
| axios | 1.13.2 | CVE-2026-40175 | MODERATE | 1.3% | 1.15.0 | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain |
| axios | 1.13.2 | CVE-2025-62718 | MODERATE | 1.2% | 1.15.0 | Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF |
| undici dev | 5.29.0 | CVE-2026-1526 | HIGH | 1.2% | 6.24.0 | Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression |
| squizlabs/php_codesniffer dev | 3.13.5 | CVE-2026-67434 | HIGH | 1.1% | 3.13.6 | PHP_CodeSniffer gitblame report command injection via crafted filename |
| axios | 1.13.2 | CVE-2026-44495 | HIGH | 1.0% | 1.15.2 | axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge |
| locutus | 2.0.32 | CVE-2026-29091 | HIGH | 1.0% | 3.0.0 | locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection |
| basic-ftp dev | 5.0.5 | CVE-2026-27699 | CRITICAL | 1.0% | 5.2.0 | Basic FTP has Path Traversal Vulnerability in its downloadToDir() method |
| flatted | 3.3.3 | CVE-2026-32141 | HIGH | 1.0% | 3.4.0 | flatted vulnerable to unbounded recursion DoS in parse() revive phase |
| flatted | 3.3.3 | CVE-2026-33228 | HIGH | 1.0% | 3.4.2 | Prototype Pollution via parse() in NodeJS flatted |
| svgo dev | 4.0.0 | CVE-2026-29074 | HIGH | 1.0% | 2.8.1 | SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) |
| axios | 1.13.2 | CVE-2026-44496 | HIGH | 1.0% | 1.16.0 | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection |
| axios | 1.13.2 | CVE-2026-42039 | MODERATE | 1.0% | 1.15.1 | Axios: unbounded recursion in toFormData causes DoS via deeply nested request data |
| axios | 1.13.2 | CVE-2026-42264 | HIGH | 1.0% | 1.15.2 | Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking |
| axios | 1.13.2 | CVE-2026-44494 | HIGH | 0.9% | 1.16.0 | axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
| axios | 1.13.2 | CVE-2026-44488 | HIGH | 0.9% | 1.16.0 | Allocation of Resources Without Limits or Throttling in Axios |
| ws dev | 8.17.1 | CVE-2026-48779 | HIGH | 0.9% | 5.2.5 | ws: Memory exhaustion DoS from tiny fragments and data chunks |
| ws dev | 7.5.10 | CVE-2026-48779 | HIGH | 0.9% | 5.2.5 | ws: Memory exhaustion DoS from tiny fragments and data chunks |
| axios | 1.13.2 | CVE-2026-42033 | HIGH | 0.9% | 1.15.1 | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking |
| path-to-regexp | 8.3.0 | CVE-2026-4926 | HIGH | 0.9% | 8.4.0 | path-to-regexp vulnerable to Denial of Service via sequential optional groups |
| @remix-run/router | 1.23.0 | CVE-2026-22029 | HIGH | 0.9% | 1.23.2 | React Router vulnerable to XSS via Open Redirects |
| undici dev | 5.29.0 | CVE-2026-2229 | HIGH | 0.9% | 6.24.0 | Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation |
| axios | 1.13.2 | CVE-2026-42044 | MODERATE | 0.9% | 1.15.2 | Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` |
| handlebars dev | 4.7.8 | CVE-2026-33938 | HIGH | 0.8% | 4.7.9 | Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block |
| locutus | 2.0.32 | CVE-2026-32304 | CRITICAL | 0.8% | 3.0.14 | Locutus vulnerable to RCE via unsanitized input in create_function() |
+ 273 further findings (mostly lower severity) — available in the full export.
SBOM summary
2786 direct dependencies scanned (2786 pinned to exact versions) from composer.lock, package-lock.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.