[Security] HIGH: 9 critical/high dependency vulns #25

New issue

Closed

opened 2026-05-16 01:56:18 +00:00 by Mark · 1 comment

Mark commented

2026-05-16 01:56:18 +00:00

Owner

Critical/High Severity Dependency Vulnerancies

@next/eslint-plugin-next

Severity: HIGH
CVEs: @next/eslint-plugin-next vuln
Current version: 14.0.5-canary.0 - 15.0.0-rc.1
Fix available: {'name': 'eslint-config-next', 'version': '16.2.6', 'isSemVerMajor': True}
Direct dependency: False
Details: @next/eslint-plugin-next (high)

eslint-config-next

Severity: HIGH
CVEs: eslint-config-next vuln
Current version: 14.0.5-canary.0 - 15.0.0-rc.1
Fix available: {'name': 'eslint-config-next', 'version': '16.2.6', 'isSemVerMajor': True}
Direct dependency: True
Details: eslint-config-next (high)

fast-xml-builder

Severity: HIGH
CVEs: 1118965
Current version: <=1.1.6
Fix available: True
Direct dependency: False
Details: fast-xml-builder: 1118965

fast-xml-parser

Severity: HIGH
CVEs: 1115339, 1116307, 1117911
Current version: <=5.6.0
Fix available: True
Direct dependency: False
Details: fast-xml-parser: 1115339 1116307 1117911

flatted

Severity: HIGH
CVEs: 1114526, 1115357
Current version: <=3.4.1
Fix available: True
Direct dependency: False
Details: flatted: 1114526 1115357

glob

Severity: HIGH
CVEs: 1109842
Current version: 10.2.0 - 10.4.5
Fix available: {'name': 'eslint-config-next', 'version': '16.2.6', 'isSemVerMajor': True}
Direct dependency: False
Details: glob: 1109842

minimatch

Severity: HIGH
CVEs: 1113459, 1113465, 1113538, 1113544, 1113546, 1113552
Current version: <=3.1.3 || 9.0.0 - 9.0.6
Fix available: True
Direct dependency: False
Details: minimatch: 1113459 1113465 1113538 1113544 1113546 1113552

Severity: HIGH
CVEs: 1112593, 1112653, 1114897, 1114940, 1116376, 1117931, 1118942, 1118944, 1118946, 1118948, 1118952, 1118954, 1118958, 1118962
Current version: 9.3.4-canary.0 - 16.3.0-canary.5
Fix available: {'name': 'next', 'version': '16.2.6', 'isSemVerMajor': True}
Direct dependency: True
Details: next: 1112593 1112653 1114897 1114940 1116376 1117931 1118942 1118944 1118946 1118948 1118952 1118954 1118958 1118962

picomatch

Severity: HIGH
CVEs: 1115549, 1115551, 1115552, 1115554
Current version: <=2.3.1 || 4.0.0 - 4.0.3
Fix available: True
Direct dependency: False
Details: picomatch: 1115549 1115551 1115552 1115554

Auto-filed by security-sweep.py on 2026-05-15 18:56 UTC

## Critical/High Severity Dependency Vulnerancies ### @next/eslint-plugin-next - **Severity:** HIGH - **CVEs:** @next/eslint-plugin-next vuln - **Current version:** 14.0.5-canary.0 - 15.0.0-rc.1 - **Fix available:** {'name': 'eslint-config-next', 'version': '16.2.6', 'isSemVerMajor': True} - **Direct dependency:** False - **Details:** @next/eslint-plugin-next (high) ### eslint-config-next - **Severity:** HIGH - **CVEs:** eslint-config-next vuln - **Current version:** 14.0.5-canary.0 - 15.0.0-rc.1 - **Fix available:** {'name': 'eslint-config-next', 'version': '16.2.6', 'isSemVerMajor': True} - **Direct dependency:** True - **Details:** eslint-config-next (high) ### fast-xml-builder - **Severity:** HIGH - **CVEs:** 1118965 - **Current version:** <=1.1.6 - **Fix available:** True - **Direct dependency:** False - **Details:** fast-xml-builder: 1118965 ### fast-xml-parser - **Severity:** HIGH - **CVEs:** 1115339, 1116307, 1117911 - **Current version:** <=5.6.0 - **Fix available:** True - **Direct dependency:** False - **Details:** fast-xml-parser: 1115339 1116307 1117911 ### flatted - **Severity:** HIGH - **CVEs:** 1114526, 1115357 - **Current version:** <=3.4.1 - **Fix available:** True - **Direct dependency:** False - **Details:** flatted: 1114526 1115357 ### glob - **Severity:** HIGH - **CVEs:** 1109842 - **Current version:** 10.2.0 - 10.4.5 - **Fix available:** {'name': 'eslint-config-next', 'version': '16.2.6', 'isSemVerMajor': True} - **Direct dependency:** False - **Details:** glob: 1109842 ### minimatch - **Severity:** HIGH - **CVEs:** 1113459, 1113465, 1113538, 1113544, 1113546, 1113552 - **Current version:** <=3.1.3 || 9.0.0 - 9.0.6 - **Fix available:** True - **Direct dependency:** False - **Details:** minimatch: 1113459 1113465 1113538 1113544 1113546 1113552 ### next - **Severity:** HIGH - **CVEs:** 1112593, 1112653, 1114897, 1114940, 1116376, 1117931, 1118942, 1118944, 1118946, 1118948, 1118952, 1118954, 1118958, 1118962 - **Current version:** 9.3.4-canary.0 - 16.3.0-canary.5 - **Fix available:** {'name': 'next', 'version': '16.2.6', 'isSemVerMajor': True} - **Direct dependency:** True - **Details:** next: 1112593 1112653 1114897 1114940 1116376 1117931 1118942 1118944 1118946 1118948 1118952 1118954 1118958 1118962 ### picomatch - **Severity:** HIGH - **CVEs:** 1115549, 1115551, 1115552, 1115554 - **Current version:** <=2.3.1 || 4.0.0 - 4.0.3 - **Fix available:** True - **Direct dependency:** False - **Details:** picomatch: 1115549 1115551 1115552 1115554 --- *Auto-filed by security-sweep.py on 2026-05-15 18:56 UTC*