CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
From 11 September 2026, an actively exploited vulnerability in software you ship must be reported to ENISA within 24 hours of awareness (CRA Art. 14). In this snapshot, 2 findings are in the CISA KEV catalog (0 in production dependencies):
| Package | Your version | CVE | Fixed in | Exploit context |
|---|---|---|---|---|
| eslint-config-prettier dev | ^8 (unpinned) | CVE-2025-54313 | 8.10.2 | KEV listed 2026-01-22 |
| eslint-plugin-prettier dev | ^4 (unpinned) | CVE-2025-54313 | 4.2.4 | KEV listed 2026-01-22 |
⚠ No lockfile — SBOM is not reproducible
This scan is based on a manifest (composer.lock, package.json), not a lockfile. 120 of 292 dependencies are version ranges, so the exact shipped versions — and their transitive dependencies — cannot be verified. Under the CRA's full obligations (11 December 2027) you must produce a machine-readable SBOM of what you actually ship. Committing a lockfile is the single highest-impact fix in this report.
All findings (91)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| axios | ^1.13.2 | CVE-2021-3749 | HIGH | 8.5% | 0.21.2 | axios Inefficient Regular Expression Complexity vulnerability |
| axios | ^1.13.2 | CVE-2019-10742 | HIGH | 6.1% | 0.18.1 | Denial of Service in axios |
| codemirror | ^5.57.0 | CVE-2020-7760 | MODERATE | 5.3% | 5.58.2 | Regular expression denial of service in codemirror |
| chart.js | ^3.8.0 | CVE-2020-7746 | HIGH | 4.7% | 2.9.4 | Prototype pollution in chart.js |
| postcss dev | ^8.5.6 | CVE-2021-23368 | MODERATE | 3.5% | 7.0.36 | Regular Expression Denial of Service in postcss |
| react-dom | npm:@hot-loader/react-dom | CVE-2018-6341 | MODERATE | 3.4% | 16.0.1 | Cross-Site Scripting in react-dom |
| xterm | ^4.19.0 | CVE-2019-0542 | HIGH | 3.2% | 3.8.1 | xterm vulnerable to remote code execution |
| postcss dev | ^8.5.6 | CVE-2021-23382 | MODERATE | 2.6% | 8.2.13 | Regular Expression Denial of Service in postcss |
| webpack-dev-server dev | ^5.2.2 | CVE-2018-14732 | HIGH | 2.6% | 3.1.11 | Missing Origin Validation in webpack-dev-server |
| axios | ^1.13.2 | CVE-2020-28168 | MODERATE | 2.4% | 0.21.1 | Axios vulnerable to Server-Side Request Forgery |
| axios | ^1.13.2 | CVE-2026-25639 | HIGH | 1.8% | 1.13.5 | Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig |
| deepmerge-ts | ^4.2.1 | CVE-2022-24802 | HIGH | 1.7% | 4.0.2 | Prototype Pollution in deepmerge-ts |
| webpack dev | ^5.103.0 | CVE-2023-28154 | CRITICAL | 1.4% | 5.76.0 | Cross-realm object access in Webpack 5 |
| axios | ^1.13.2 | CVE-2026-40175 | MODERATE | 1.3% | 1.15.0 | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain |
| axios | ^1.13.2 | CVE-2024-39338 | HIGH | 1.2% | 1.7.4 | Server-Side Request Forgery in axios |
| axios | ^1.13.2 | CVE-2025-62718 | MODERATE | 1.2% | 1.15.0 | Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF |
| axios | ^1.13.2 | CVE-2025-58754 | HIGH | 1.1% | 1.12.0 | Axios is vulnerable to DoS attack through lack of data size check |
| axios | ^1.13.2 | CVE-2026-44495 | HIGH | 1.0% | 1.15.2 | axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge |
| i18next | ^25.8.0 | CVE-2017-16010 | MODERATE | 1.0% | 3.4.4 | Cross-Site Scripting in i18next |
| axios | ^1.13.2 | CVE-2026-44496 | HIGH | 1.0% | 1.16.0 | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection |
| axios | ^1.13.2 | CVE-2026-42039 | MODERATE | 1.0% | 1.15.1 | Axios: unbounded recursion in toFormData causes DoS via deeply nested request data |
| axios | ^1.13.2 | CVE-2026-42264 | HIGH | 1.0% | 1.15.2 | Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking |
| webpack dev | ^5.103.0 | CVE-2024-43788 | MODERATE | 1.0% | 5.94.0 | Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS |
| axios | ^1.13.2 | CVE-2026-44494 | HIGH | 0.9% | 1.16.0 | axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
| axios | ^1.13.2 | CVE-2026-44488 | HIGH | 0.9% | 1.16.0 | Allocation of Resources Without Limits or Throttling in Axios |
| axios | ^1.13.2 | CVE-2026-42033 | HIGH | 0.9% | 1.15.1 | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking |
| i18next | ^25.8.0 | CVE-2017-16008 | MODERATE | 0.9% | 1.10.3 | Cross-Site Scripting in i18next |
| axios | ^1.13.2 | CVE-2026-42044 | MODERATE | 0.9% | 1.15.2 | Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` |
| postcss dev | ^8.5.6 | CVE-2023-44270 | MODERATE | 0.8% | 8.4.31 | PostCSS line return parsing error |
| axios | ^1.13.2 | CVE-2026-42041 | MODERATE | 0.8% | 1.15.1 | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy |
+ 61 further findings (mostly lower severity) — available in the full export.
SBOM summary
292 direct dependencies scanned (172 pinned to exact versions) from composer.lock, package.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.