@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +609 more potentially affected by CVE-2026-11417 via aws-cdk-lib (>=2.0.0, <=2.245.0)

aws-cdk-lib NPM version =2.0.0, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =1.2.15, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.7.28 and more Source cves: CVE-2026-11417 Source advisory: OSV:GHSA-999R-QQ7V-R334...

@0xwork/connect (>=0.1.0, <=0.1.8), @7n/rules (>=1.0.0, <=1.118.11) +444 more potentially affected by CVE-2026-48988 via markdown-it (>=14.0.0, <=14.1.1)

markdown-it NPM version =14.0.0, =0.1.0, =1.0.0, =4.10.0, =2026.4.23-zh, =2.3.0, =1.0.0, =0.25.7, =0.12.2, =3.0.0, =1.6.8, =0.1.1, =0.1.1, =8.1.3, =8.4.0 and more Source cves: CVE-2026-48988 Source advisory: SNYK:JS-MARKDOWNIT-17353909...

@0xwork/connect (>=0.1.0, <=0.1.8), @7n/rules (>=1.0.0, <=1.118.11) +444 more potentially affected by CVE-2026-48988 via markdown-it (>=14.0.0, <=14.1.1)

markdown-it NPM version =14.0.0, =0.1.0, =1.0.0, =4.10.0, =2026.4.23-zh, =2.3.0, =1.0.0, =0.25.7, =0.12.2, =3.0.0, =1.6.8, =0.1.1, =0.1.1, =8.1.3, =8.4.0 and more Source cves: CVE-2026-48988 Source advisory: OSV:GHSA-6V5V-WF23-FMFQ...

0perator (>=0.1.0, <=0.3.0), @0byte/oc_mlflow_plugin (>=0.1.1, <=0.1.3) +4015 more potentially affected by CVE-2026-54285 via @opentelemetry/core (>=2.0.0, <=2.7.1)

@opentelemetry/core NPM version =2.0.0, =0.1.0, =0.1.1, =0.0.1, =1.3.0, =0.1.0, =1.2.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.1.1, =0.1.1, =0.1.23 and more Source cves: CVE-2026-54285 Source advisory: OSV:GHSA-8988-4F7V-96QF...

0perator (>=0.1.0, <=0.3.0), @0byte/oc_mlflow_plugin (>=0.1.1, <=0.1.3) +4015 more potentially affected by CVE-2026-54285 via @opentelemetry/core (>=2.0.0, <=2.7.1)

@opentelemetry/core NPM version =2.0.0, =0.1.0, =0.1.1, =0.0.1, =1.3.0, =0.1.0, =1.2.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.1.1, =0.1.1, =0.1.23 and more Source cves: CVE-2026-54285 Source advisory: SNYK:JS-OPENTELEMETRYCORE-17373280...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @dismissible/nestjs-api (>=1.0.3-alpha.0b30e6d.0, <=2.0.2-canary.2913ba8.0) +8 more potentially affected by CVE-2026-54281 via @nestjs/platform-fastify (>=11.0.1, <=11.1.23)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =1.3.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: CVE-2026-54281 Source advisory: OSV:GHSA-6V32-FJC9-9QF6...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @dismissible/nestjs-api (>=1.0.3-alpha.0b30e6d.0, <=2.0.2-canary.2913ba8.0) +9 more potentially affected by CVE-2026-54281 via @nestjs/platform-fastify (>=11.0.1, <=11.1.24)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: CVE-2026-54281 Source advisory: SNYK:JS-NESTJSPLATFORMFASTIFY-17374830...

com.drivetribe:orchestra-core_sjs0.6_2.12 (>=0.1, <=0.7), com.drivetribe:orchestra-cron_sjs0.6_2.12 (>=0.1, <=0.7) +123 more potentially affected by CVE-2026-48125 via org.webjars.npm:ua-parser-js (>=0.7.41, <=2.0.0-alpha.3)

org.webjars.npm:ua-parser-js MAVEN version =0.7.41, =0.1, =0.1, =0.1, =0.8, =0.8, =0.8, =7.1.0-rc6, =7.1.0-rc3, =7.1.0-rc3, =7.1.0-rc3, =1.0.0-rc2, =1.0.0-rc2, =1.0.5 and more Source cves: CVE-2026-48125 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17353323...

@aircall/http (1.7.7), @breadstone/archipel-platform-analytics (>=0.0.2, <=0.0.13) +59 more potentially affected by CVE-2026-48125 via ua-parser-js (>=2.0.1, <=2.0.9)

ua-parser-js NPM version =2.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.5.9-develop-pedago.20260213101441, =0.2.2-develop-pedago.2, =1.0.2-develop.0.20260622083059 and more Source cves: CVE-2026-48125 Source advisory:...

@aircall/http (1.7.7), @breadstone/archipel-platform-analytics (>=0.0.2, <=0.0.13) +59 more potentially affected by CVE-2026-48125 via ua-parser-js (>=2.0.1, <=2.0.9)

ua-parser-js NPM version =2.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.5.9-develop-pedago.20260213101441, =0.2.2-develop-pedago.2, =1.0.2-develop.0.20260622083059 and more Source cves: CVE-2026-48125 Source advisory:...

@forwardimpact/libcodegen (>=0.1.47, <=0.1.52) potentially affected by CVE-2026-54271 via protobufjs-cli (2.0.1)

protobufjs-cli NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs-cli and may be impacted: - @forwardimpact/libcodegen =0.1.47, =0.1.52 Source cves: CVE-2026-54271 Source advisory: SNYK:JS-PROTOBUFJSCLI-17362836...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1541 more potentially affected by CVE-2026-54271 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54271 Source advisory: SNYK:JS-PROTOBUFJSCLI-17362836...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3463 more potentially affected by CVE-2026-54271 via protobufjs (>=7.0.0, <=7.6.1)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =4.0.1 and more Source cves: CVE-2026-54271 Source advisory: SNYK:JS-PROTOBUFJS-17362837...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1110 more potentially affected by CVE-2026-54271 via protobufjs (>=8.0.0, <=8.4.2)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.6.0, =0.8.0 and more Source cves: CVE-2026-54271 Source advisory: SNYK:JS-PROTOBUFJS-17362837...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1541 more potentially affected by CVE-2026-54271 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54271 Source advisory: OSV:GHSA-PR59-H9PH-3FR8...

@forwardimpact/libcodegen (>=0.1.47, <=0.1.52) potentially affected by CVE-2026-54271 via protobufjs-cli (2.0.1)

protobufjs-cli NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs-cli and may be impacted: - @forwardimpact/libcodegen =0.1.47, =0.1.52 Source cves: CVE-2026-54271 Source advisory: OSV:GHSA-PR59-H9PH-3FR8...

@agentbadge/mcp (0.1.9), @agentbadge/passport (>=0.1.8, <=0.2.1) +104 more potentially affected by CVE-2026-54270 via protobufjs (>=8.2.0, <=8.4.2)

protobufjs NPM version =8.2.0, =0.1.8, =0.1.1, =0.1.1, =1.16.0, =1.0.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.3.1, =0.1.37, =0.1.41 and more Source cves: CVE-2026-54270 Source advisory: SNYK:JS-PROTOBUFJS-17353318...

@agentbadge/mcp (0.1.9), @agentbadge/passport (>=0.1.8, <=0.2.1) +104 more potentially affected by CVE-2026-54270 via protobufjs (>=8.2.0, <=8.4.2)

protobufjs NPM version =8.2.0, =0.1.8, =0.1.1, =0.1.1, =1.16.0, =1.0.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.3.1, =0.1.37, =0.1.41 and more Source cves: CVE-2026-54270 Source advisory: OSV:GHSA-94RC-8X27-4472...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2394 more potentially affected by CVE-2026-65899 via dompurify (>=3.0.0, <=3.4.8)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =6.3.4 and more Source cves: CVE-2026-65899 Source advisory: OSV:GHSA-VXR8-FQ34-VVX9...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2394 more potentially affected by unknown CVE via dompurify (>=3.0.0, <=3.4.8)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =6.3.4 and more Source cves: unknown CVE Source advisory: SNYK:JS-DOMPURIFY-17344552...