[VANTA] [VULNERABILITY] <HIGH> CVE-2026-27977, CVE-2026-27978, CVE-2026-27979 and others, fix before 2026-04-25

Important

CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.

DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

FIXED npm-picomatch >= 4.0.0, < 4.0.4 CVE-2026-33671 HIGH

npm-picomatch >= 4.0.0, < 4.0.4 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-33671 HIGH remediate by: 2026-04-25T14:19:30.796Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/248

Related URLs

GHSA-c2c7-rcm5-vvqj

micromatch/picomatch@5eceecd

https://nvd.nist.gov/vuln/detail/CVE-2026-33671

GHSA-c2c7-rcm5-vvqj

FIXED npm-picomatch >= 4.0.0, < 4.0.4 CVE-2026-33672 MEDIUM

npm-picomatch >= 4.0.0, < 4.0.4 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-33672 MEDIUM remediate by: 2026-05-25T14:19:31.055Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/243

Related URLs

GHSA-3v7f-55p6-f55p

micromatch/picomatch@4516eb5

https://nvd.nist.gov/vuln/detail/CVE-2026-33672

GHSA-3v7f-55p6-f55p

FIXED npm-picomatch < 2.3.2 CVE-2026-33671 HIGH

npm-picomatch < 2.3.2 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-33671 HIGH remediate by: 2026-04-29T22:15:21.750Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/240

Related URLs

GHSA-c2c7-rcm5-vvqj

micromatch/picomatch@5eceecd

https://nvd.nist.gov/vuln/detail/CVE-2026-33671

GHSA-c2c7-rcm5-vvqj

FIXED npm-picomatch < 2.3.2 CVE-2026-33672 MEDIUM

npm-picomatch < 2.3.2 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-33672 MEDIUM remediate by: 2026-05-29T22:15:22.072Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/239

Related URLs

GHSA-3v7f-55p6-f55p

micromatch/picomatch@4516eb5

https://nvd.nist.gov/vuln/detail/CVE-2026-33672

GHSA-3v7f-55p6-f55p

FIXED npm-h3 < 1.15.6 CVE-2026-33128 HIGH

npm-h3 < 1.15.6 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-33128 HIGH remediate by: 2026-04-29T22:15:21.750Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/234

Related URLs

GHSA-22cc-p3c6-wpvm

h3js/h3@7791538

https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/internal/event-stream.ts#L170-L187

https://nvd.nist.gov/vuln/detail/CVE-2026-33128

GHSA-22cc-p3c6-wpvm

FIXED npm-h3 < 1.15.6 GHSA-wr4h-v87w-p3r7 MEDIUM

npm-h3 < 1.15.6 CODE_REPOSITORY/commercelayer-js-auth GHSA-wr4h-v87w-p3r7 MEDIUM remediate by: 2026-05-29T22:15:22.072Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/233

Related URLs

GHSA-wr4h-v87w-p3r7

h3js/h3@0e751b4

https://github.com/h3js/h3/blob/52c82e18bb643d124b8b9ec3b1f62b081f044611/src/utils/static.ts#L86

GHSA-wr4h-v87w-p3r7

FIXED npm-defu <= 6.1.4 CVE-2026-35209 HIGH

npm-defu <= 6.1.4 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-35209 HIGH remediate by: 2026-05-04T14:17:32.574Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/262

Related URLs

GHSA-737v-mqg7-c878

https://nvd.nist.gov/vuln/detail/CVE-2026-35209

fix: prevent prototype pollution via __proto__ unjs/defu#156

unjs/defu@3942bfb

https://github.com/unjs/defu/releases/tag/v6.1.5

GHSA-737v-mqg7-c878

FIXED npm-vite >= 7.0.0, <= 7.3.1 CVE-2026-39363 HIGH

npm-vite >= 7.0.0, <= 7.3.1 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-39363 HIGH remediate by: 2026-05-07T06:20:48.749Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/272

Related URLs

GHSA-p9ff-h696-f583

fix: apply server.fs check to env transport vitejs/vite#22159

vitejs/vite@f02d9fd

https://github.com/vitejs/vite/releases/tag/v6.4.2

https://github.com/vitejs/vite/releases/tag/v7.3.2

https://github.com/vitejs/vite/releases/tag/v8.0.5

https://nvd.nist.gov/vuln/detail/CVE-2026-39363

GHSA-p9ff-h696-f583

FIXED npm-vite >= 7.0.0, <= 7.3.1 CVE-2026-39365 MEDIUM

npm-vite >= 7.0.0, <= 7.3.1 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-39365 MEDIUM remediate by: 2026-06-06T14:36:41.686Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/277

Related URLs

GHSA-4w7w-66w2-5vf9

fix: avoid path traversal with optimize deps sourcemap handler vitejs/vite#22161

vitejs/vite@79f002f

https://github.com/vitejs/vite/releases/tag/v6.4.2

https://github.com/vitejs/vite/releases/tag/v7.3.2

https://github.com/vitejs/vite/releases/tag/v8.0.5

https://nvd.nist.gov/vuln/detail/CVE-2026-39365

GHSA-4w7w-66w2-5vf9

FIXED npm-vite >= 7.1.0, <= 7.3.1 CVE-2026-39364 HIGH

npm-vite >= 7.1.0, <= 7.3.1 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-39364 HIGH remediate by: 2026-05-07T14:36:41.372Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/267

Related URLs

GHSA-v2wj-q39q-566r

fix: check server.fs after stripping query as well vitejs/vite#22160

vitejs/vite@a9a3df2

https://github.com/vitejs/vite/releases/tag/v7.3.2

https://github.com/vitejs/vite/releases/tag/v8.0.5

https://nvd.nist.gov/vuln/detail/CVE-2026-39364

GHSA-v2wj-q39q-566r

FIXED npm-next >= 16.0.0-beta.0, < 16.2.3 GHSA-q4gf-8mx6-v5v3 HIGH

npm-next >= 16.0.0-beta.0, < 16.2.3 CODE_REPOSITORY/commercelayer-js-auth GHSA-q4gf-8mx6-v5v3 HIGH remediate by: 2026-05-11T06:21:49.843Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/280

Related URLs

GHSA-q4gf-8mx6-v5v3

https://vercel.com/changelog/summary-of-cve-2026-23869

GHSA-q4gf-8mx6-v5v3

FIXED npm-h3 <= 1.15.8 GHSA-72gr-qfp7-vwhw MEDIUM

npm-h3 <= 1.15.8 CODE_REPOSITORY/commercelayer-js-auth GHSA-72gr-qfp7-vwhw MEDIUM remediate by: 2026-05-29T22:15:22.072Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/237

Related URLs

GHSA-72gr-qfp7-vwhw

GHSA-72gr-qfp7-vwhw

FIXED npm-h3 < 1.15.9 GHSA-4hxc-9384-m385 MEDIUM

npm-h3 < 1.15.9 CODE_REPOSITORY/commercelayer-js-auth GHSA-4hxc-9384-m385 MEDIUM remediate by: 2026-05-29T22:15:22.072Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/238

Related URLs

GHSA-4hxc-9384-m385

GHSA-4hxc-9384-m385

FIXED npm-next >= 16.0.0-beta.0, < 16.1.7 CVE-2026-27980 MEDIUM

npm-next >= 16.0.0-beta.0, < 16.1.7 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-27980 MEDIUM remediate by: 2026-05-29T22:15:22.072Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/236

Related URLs

GHSA-3x4c-7xq6-9pq8

vercel/next.js@39eb8e0

https://github.com/vercel/next.js/releases/tag/v16.1.7

https://nvd.nist.gov/vuln/detail/CVE-2026-27980

GHSA-3x4c-7xq6-9pq8

FIXED npm-next >= 16.0.0-beta.0, < 16.1.7 CVE-2026-29057 MEDIUM

npm-next >= 16.0.0-beta.0, < 16.1.7 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-29057 MEDIUM remediate by: 2026-05-29T22:15:22.072Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/232

Related URLs

GHSA-ggv3-7p47-pfv8

vercel/next.js@dc98c04

https://github.com/vercel/next.js/releases/tag/v15.5.13

https://github.com/vercel/next.js/releases/tag/v16.1.7

https://nvd.nist.gov/vuln/detail/CVE-2026-29057

GHSA-ggv3-7p47-pfv8

FIXED npm-next >= 16.0.1, < 16.1.7 CVE-2026-27978 MEDIUM

npm-next >= 16.0.1, < 16.1.7 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-27978 MEDIUM remediate by: 2026-05-29T22:15:22.072Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/228

Related URLs

GHSA-mq59-m269-xvcx

vercel/next.js@a27a11d

https://github.com/vercel/next.js/releases/tag/v16.1.7

https://nvd.nist.gov/vuln/detail/CVE-2026-27978

GHSA-mq59-m269-xvcx

FIXED npm-next >= 16.0.1, < 16.1.7 CVE-2026-27979 MEDIUM

npm-next >= 16.0.1, < 16.1.7 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-27979 MEDIUM remediate by: 2026-05-29T22:15:22.072Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/230

Related URLs

GHSA-h27x-g6w4-24gq

vercel/next.js@c885d48

https://github.com/vercel/next.js/releases/tag/v16.1.7

https://nvd.nist.gov/vuln/detail/CVE-2026-27979

GHSA-h27x-g6w4-24gq

FIXED npm-next >= 16.0.1, < 16.1.7 CVE-2026-27977 LOW

npm-next >= 16.0.1, < 16.1.7 CODE_REPOSITORY/commercelayer-js-auth CVE-2026-27977 LOW remediate by: 2026-06-28T22:15:22.360Z

https://github.com/commercelayer/commercelayer-js-auth/security/dependabot/226

Related URLs

GHSA-jcc7-9wpm-mj36

vercel/next.js@862f9b9

https://github.com/vercel/next.js/releases/tag/v16.1.7

https://nvd.nist.gov/vuln/detail/CVE-2026-27977

GHSA-jcc7-9wpm-mj36

No vulnerability is detected anymore.

Navigation Menu

Repository navigation

[VANTA] [VULNERABILITY] <HIGH> CVE-2026-27977, CVE-2026-27978, CVE-2026-27979 and others, fix before 2026-04-25 #129

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[VANTA] [VULNERABILITY] <HIGH> CVE-2026-27977, CVE-2026-27978, CVE-2026-27979 and others, fix before 2026-04-25 #129

Description

Activity

commercelayer-ci commented on Apr 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions