CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
No dependency in this snapshot currently appears in CISA's Known Exploited Vulnerabilities catalog. Today, nothing would trigger the 24-hour early-warning obligation of CRA Art. 14. That can change any day a new KEV entry lands, which is exactly what continuous monitoring is for.
All findings (6)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| braces | 3.0.3 | CVE-2026-93687 | HIGH | 0.7% | — | braces vulnerable to stack-exhaustion denial of service through deeply nested patterns |
| http-cache-semantics | 4.2.0 | CVE-2026-93748 | HIGH | 0.5% | — | http-cache-semantics max-stale handling can disclose cross-user cached responses |
| brace-expansion | 5.0.9 | CVE-2026-102276 | HIGH | 0.4% | 5.0.10 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| brace-expansion | 5.0.9 | CVE-2026-102278 | HIGH | 0.4% | 5.0.11 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| brace-expansion | 5.0.9 | CVE-2026-102277 | MODERATE | 0.3% | 5.0.12 | brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
| fast-uri | 3.1.7 | CVE-2026-86472 | MODERATE | 0.3% | 2.4.7 | fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets |
SBOM summary
853 direct dependencies scanned (853 pinned to exact versions) from composer.lock, package-lock.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.