react-4.4.2.tgz: 10 vulnerabilities (highest severity is: 8.3)

[mend-bolt-for-github]

Vulnerable Library - react-4.4.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/@⁠babel/core/package.json

Found in HEAD commit: 37cad163797def09781066683d4aa4acf8c4d597

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (react version)	Remediation Possible**
CVE-2026-53632	High	8.3	vite-6.4.2.tgz	Transitive	N/A*	❌
CVE-2026-73646	High	7.5	postcss-8.5.13.tgz	Transitive	N/A*	❌
CVE-2026-73089	High	7.5	browserslist-4.28.2.tgz	Transitive	N/A*	❌
CVE-2026-73088	High	7.5	browserslist-4.28.2.tgz	Transitive	N/A*	❌
CVE-2026-53571	High	7.5	vite-6.4.2.tgz	Transitive	N/A*	❌
CVE-2026-45819	High	7.5	baseline-browser-mapping-2.10.27.tgz	Transitive	N/A*	❌
CVE-2026-67214	Medium	5.9	nanoid-3.3.12.tgz	Transitive	N/A*	❌
CVE-2026-67213	Medium	5.9	nanoid-3.3.12.tgz	Transitive	N/A*	❌
CVE-2026-69153	Medium	5.3	postcss-8.5.13.tgz	Transitive	N/A*	❌
CVE-2026-49356	Low	3.2	core-7.29.0.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-53632

Vulnerable Library - vite-6.4.2.tgz

Native-ESM powered web dev build tool

Library home page: https://registry.npmjs.org/vite/-/vite-6.4.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/vite/package.json

Dependency Hierarchy:

• react-4.4.2.tgz (Root Library)
  • ❌ vite-6.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 37cad163797def09781066683d4aa4acf8c4d597

Found in base branch: main

Vulnerability Details

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

Publish Date: 2026-06-22

URL: CVE-2026-53632

CVSS 3 Score Details (8.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-15

Fix Resolution: https://github.com/vitejs/vite.git - v8.0.16,https://github.com/vitejs/vite.git - v6.4.3,https://github.com/vitejs/launch-editor.git - v2.14.1,https://github.com/vitejs/vite.git - v7.3.5

Step up your Open Source Security Game with Mend here

CVE-2026-73646

Vulnerable Library - postcss-8.5.13.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.13.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/postcss/package.json

Dependency Hierarchy:

• react-4.4.2.tgz (Root Library)
  • vite-6.4.2.tgz
    • ❌ postcss-8.5.13.tgz (Vulnerable Library)

Found in HEAD commit: 37cad163797def09781066683d4aa4acf8c4d597

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.

Publish Date: 2026-08-17

URL: CVE-2026-73646

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-13

Fix Resolution: https://github.com/postcss/postcss.git - 8.5.18

Step up your Open Source Security Game with Mend here

CVE-2026-73089

Vulnerable Library - browserslist-4.28.2.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/browserslist/package.json

Dependency Hierarchy:

• react-4.4.2.tgz (Root Library)
  • plugin-react-4.7.0.tgz
    • core-7.29.0.tgz
      • helper-compilation-targets-7.28.6.tgz
        • ❌ browserslist-4.28.2.tgz (Vulnerable Library)

Found in HEAD commit: 37cad163797def09781066683d4aa4acf8c4d597

Found in base branch: main

Vulnerability Details

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct "(queries, context)" result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since "--" queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.

Publish Date: 2026-08-11

URL: CVE-2026-73089

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c83g-rgw3-j3cx

Release Date: 2026-08-11

Fix Resolution: browserslist - 4.28.7,https://github.com/browserslist/browserslist.git - 4.28.7

Step up your Open Source Security Game with Mend here

CVE-2026-73088

Vulnerable Library - browserslist-4.28.2.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/browserslist/package.json

Dependency Hierarchy:

• react-4.4.2.tgz (Root Library)
  • plugin-react-4.7.0.tgz
    • core-7.29.0.tgz
      • helper-compilation-targets-7.28.6.tgz
        • ❌ browserslist-4.28.2.tgz (Vulnerable Library)

Found in HEAD commit: 37cad163797def09781066683d4aa4acf8c4d597

Found in base branch: main

Vulnerability Details

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including proto, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-08-11

URL: CVE-2026-73088

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-73wf-gq98-2v4g

Release Date: 2026-08-11

Fix Resolution: browserslist - 4.28.7,https://github.com/browserslist/browserslist.git - 4.28.7

Step up your Open Source Security Game with Mend here

CVE-2026-53571

Vulnerable Library - vite-6.4.2.tgz

Native-ESM powered web dev build tool

Library home page: https://registry.npmjs.org/vite/-/vite-6.4.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/vite/package.json

Dependency Hierarchy:

• react-4.4.2.tgz (Root Library)
  • ❌ vite-6.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 37cad163797def09781066683d4aa4acf8c4d597

Found in base branch: main

Vulnerability Details

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.

Publish Date: 2026-06-22

URL: CVE-2026-53571

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-15

Fix Resolution: https://github.com/vitejs/vite.git - v6.4.3,https://github.com/vitejs/vite.git - v8.0.16,https://github.com/vitejs/vite.git - v7.3.5

Step up your Open Source Security Game with Mend here

CVE-2026-45819

Vulnerable Library - baseline-browser-mapping-2.10.27.tgz

A library for obtaining browser versions with their maximum supported Baseline feature set and Widely Available status.

Library home page: https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.27.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/baseline-browser-mapping/package.json

Dependency Hierarchy:

• react-4.4.2.tgz (Root Library)
  • plugin-react-4.7.0.tgz
    • core-7.29.0.tgz
      • helper-compilation-targets-7.28.6.tgz
        • browserslist-4.28.2.tgz
          • ❌ baseline-browser-mapping-2.10.27.tgz (Vulnerable Library)

Found in HEAD commit: 37cad163797def09781066683d4aa4acf8c4d597

Found in base branch: main

Vulnerability Details

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

Publish Date: 2026-08-13

URL: CVE-2026-45819

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-13

Fix Resolution: baseline-browser-mapping - 2.11.0

Step up your Open Source Security Game with Mend here

CVE-2026-67214

Vulnerable Library - nanoid-3.3.12.tgz

A tiny (116 bytes), secure URL-friendly unique string ID generator

Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/nanoid/package.json

Dependency Hierarchy:

• react-4.4.2.tgz (Root Library)
  • vite-6.4.2.tgz
    • postcss-8.5.13.tgz
      • ❌ nanoid-3.3.12.tgz (Vulnerable Library)

Found in HEAD commit: 37cad163797def09781066683d4aa4acf8c4d597

Found in base branch: main

Vulnerability Details

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Publish Date: 2026-07-29

URL: CVE-2026-67214

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-07-29

Fix Resolution: https://github.com/ai/nanoid.git - 5.1.16

Step up your Open Source Security Game with Mend here

CVE-2026-67213

Vulnerable Library - nanoid-3.3.12.tgz

A tiny (116 bytes), secure URL-friendly unique string ID generator

Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/nanoid/package.json

Dependency Hierarchy:

• react-4.4.2.tgz (Root Library)
  • vite-6.4.2.tgz
    • postcss-8.5.13.tgz
      • ❌ nanoid-3.3.12.tgz (Vulnerable Library)

Found in HEAD commit: 37cad163797def09781066683d4aa4acf8c4d597

Found in base branch: main

Vulnerability Details

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Publish Date: 2026-07-29

URL: CVE-2026-67213

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-07-29

Fix Resolution: https://github.com/ai/nanoid.git - 5.1.6

Step up your Open Source Security Game with Mend here

CVE-2026-69153

Vulnerable Library - postcss-8.5.13.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.13.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/postcss/package.json

Dependency Hierarchy:

• react-4.4.2.tgz (Root Library)
  • vite-6.4.2.tgz
    • ❌ postcss-8.5.13.tgz (Vulnerable Library)

Found in HEAD commit: 37cad163797def09781066683d4aa4acf8c4d597

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

Publish Date: 2026-08-03

URL: CVE-2026-69153

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-03

Fix Resolution: https://github.com/postcss/postcss.git - 8.5.23

Step up your Open Source Security Game with Mend here

CVE-2026-49356

Vulnerable Library - core-7.29.0.tgz

Babel compiler core.

Library home page: https://registry.npmjs.org/@⁠babel/core/-/core-7.29.0.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/@⁠babel/core/package.json

Dependency Hierarchy:

• react-4.4.2.tgz (Root Library)
  • plugin-react-4.7.0.tgz
    • ❌ core-7.29.0.tgz (Vulnerable Library)

Found in HEAD commit: 37cad163797def09781066683d4aa4acf8c4d597

Found in base branch: main

Vulnerability Details

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @⁠babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @⁠babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

Publish Date: 2026-06-22

URL: CVE-2026-49356

CVSS 3 Score Details (3.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-15

Fix Resolution: https://github.com/babel/babel.git - 7.29.6,https://github.com/babel/babel.git - 8.0.0-rc.6

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.