CRA Readiness Snapshot
0 days
until the EU Cyber Resilience Act 24-hour reporting obligation applies (11 September 2026), including for products already on the market.
425
dependencies in scope
69
known vulnerabilities
0
actively exploited (CISA KEV)
2.6%
highest exploit probability (EPSS)
What you would have to assess for ENISA reporting tomorrow
No dependency in this snapshot currently appears in CISA's Known Exploited Vulnerabilities catalog. Today, nothing would trigger the 24-hour early-warning obligation of CRA Art. 14. That can change any day a new KEV entry lands, which is exactly what continuous monitoring is for.
All findings (69)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| lodash dev | 4.17.21 | CVE-2026-4800 | HIGH | 2.6% | 4.18.0 | lodash vulnerable to Code Injection via `_.template` imports key names |
| axios dev | 1.11.0 | CVE-2026-40175 | MODERATE | 2.0% | 1.15.0 | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain |
| axios dev | 1.11.0 | CVE-2026-25639 | HIGH | 2.0% | 1.13.5 | Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig |
| lodash dev | 4.17.21 | CVE-2025-13465 | MODERATE | 1.8% | 4.17.23 | Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions |
| rollup dev | 4.47.1 | CVE-2026-27606 | HIGH | 1.6% | 2.80.0 | Rollup 4 has Arbitrary File Write via Path Traversal |
| vite dev | 5.4.19 | CVE-2026-112942 | HIGH | 1.3% | 8.3.3 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
| vite dev | 5.4.19 | CVE-2025-58751 | LOW | 1.2% | 7.1.5 | Vite middleware may serve files starting with the same name with the public directory |
| axios dev | 1.11.0 | CVE-2025-58754 | HIGH | 1.2% | 1.12.0 | Axios is vulnerable to DoS attack through lack of data size check |
| axios dev | 1.11.0 | CVE-2025-62718 | MODERATE | 1.2% | 1.15.0 | Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF |
| vite dev | 5.4.19 | CVE-2025-62522 | MODERATE | 1.1% | 7.1.11 | vite allows server.fs.deny bypass via backslash on Windows |
| axios dev | 1.11.0 | CVE-2026-44495 | HIGH | 1.0% | 1.15.2 | axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge |
| vite dev | 5.4.19 | CVE-2026-39365 | MODERATE | 1.0% | 8.0.5 | Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling |
| axios dev | 1.11.0 | CVE-2026-44496 | HIGH | 1.0% | 1.16.0 | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection |
| axios dev | 1.11.0 | CVE-2026-42039 | MODERATE | 1.0% | 1.15.1 | Axios: unbounded recursion in toFormData causes DoS via deeply nested request data |
| axios dev | 1.11.0 | CVE-2026-44494 | HIGH | 0.9% | 1.16.0 | axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
| axios dev | 1.11.0 | CVE-2026-44488 | HIGH | 0.9% | 1.16.0 | Allocation of Resources Without Limits or Throttling in Axios |
| axios dev | 1.11.0 | CVE-2026-42033 | HIGH | 0.9% | 1.15.1 | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking |
| vite dev | 5.4.19 | CVE-2026-112946 | MODERATE | 0.9% | 8.3.3 | Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
| shell-quote dev | 1.8.3 | CVE-2026-9277 | CRITICAL | 0.8% | 1.8.4 | shell-quote quote() does not escape newlines in object .op values |
| follow-redirects dev | 1.15.11 | CVE-2026-40895 | MODERATE | 0.8% | 1.16.0 | follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets |
| axios dev | 1.11.0 | CVE-2026-42041 | MODERATE | 0.8% | 1.15.1 | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy |
| axios dev | 1.11.0 | CVE-2026-42264 | HIGH | 0.8% | 1.15.2 | Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking |
| axios dev | 1.11.0 | CVE-2026-44486 | HIGH | 0.8% | 1.16.0 | Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection |
| axios dev | 1.11.0 | CVE-2026-44487 | HIGH | 0.8% | 1.16.0 | Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter |
| axios dev | 1.11.0 | CVE-2026-42043 | HIGH | 0.7% | 1.15.1 | Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 |
| vite dev | 5.4.19 | CVE-2026-112944 | MODERATE | 0.7% | 8.3.3 | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
| form-data dev | 4.0.4 | CVE-2026-12143 | HIGH | 0.7% | 2.5.6 | form-data: CRLF injection in form-data via unescaped multipart field names and filenames |
| browserslist dev | 4.25.3 | CVE-2026-73088 | HIGH | 0.7% | 4.28.7 | Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) |
| browserslist dev | 4.25.3 | CVE-2026-73089 | HIGH | 0.7% | 4.28.7 | Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM |
| tar dev | 7.4.3 | CVE-2026-59871 | MODERATE | 0.6% | 7.5.18 | node-tar: Process crash via PAX numeric path type confusion |
+ 39 further findings (mostly lower severity) — available in the full export.
SBOM summary
425 direct dependencies scanned (425 pinned to exact versions) from composer.lock, package-lock.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.
Download SBOM (CycloneDX)
Want this to watch your product continuously and draft the ENISA report the day something turns exploited?
Start monitoring for €99/mo
Talk to us