🔒 Security Alerts — IBM/template-node-typescript
Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.
SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.
💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.
📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.
Attention: (no direct admin collaborators assigned to this repo — please add an admin to receive security notifications)
Dependabot Alerts
| Severity |
CVE/GHSA |
Package |
Affected |
Patched |
Fix PR |
| 🟠 high |
CVE-2026-4867 |
path-to-regexp |
< 0.1.13 |
0.1.13 |
— |
| 🟠 high |
CVE-2026-4800 |
lodash |
>= 4.0.0, <= 4.17.23 |
4.18.0 |
— |
| 🟠 high |
CVE-2026-42043 |
axios |
<= 0.31.0 |
0.31.1 |
— |
| 🟠 high |
CVE-2026-42033 |
axios |
<= 0.31.0 |
0.31.1 |
— |
| 🟠 high |
CVE-2026-42035 |
axios |
<= 0.31.0 |
0.31.1 |
— |
| 🟠 high |
CVE-2026-44705 |
tmp |
< 0.2.6 |
0.2.6 |
— |
| 🟠 high |
CVE-2026-44492 |
axios |
<= 0.31.1 |
0.32.0 |
— |
| 🟠 high |
CVE-2026-44495 |
axios |
>= 0.19.0, < 0.31.1 |
0.31.1 |
— |
| 🟠 high |
CVE-2026-44487 |
axios |
<= 0.31.1 |
0.32.0 |
— |
| 🟠 high |
CVE-2026-44486 |
axios |
<= 0.31.1 |
0.32.0 |
— |
| 🟠 high |
CVE-2026-44496 |
axios |
<= 0.31.1 |
0.32.0 |
— |
| 🟠 high |
CVE-2026-12143 |
form-data |
>= 4.0.0, < 4.0.6 |
4.0.6 |
— |
| 🟠 high |
CVE-2026-5079 |
multer |
>= 1.0.0, < 2.2.0 |
2.2.0 |
— |
| 🟠 high |
CVE-2026-13149 |
brace-expansion |
>= 2.0.0, < 2.1.2 |
2.1.2 |
— |
| 🟠 high |
CVE-2026-59869 |
js-yaml |
>= 4.0.0, < 4.3.0 |
4.3.0 |
— |
| 🟠 high |
CVE-2026-14257 |
brace-expansion |
>= 2.0.0, < 2.1.3 |
2.1.3 |
— |
| 🟠 high |
CVE-2026-69152 |
brace-expansion |
>= 2.0.0, < 2.1.4 |
2.1.4 |
— |
| 🟠 high |
GHSA-5p4m-2wfm-xmqj |
js-yaml |
>= 3.0.0, < 3.15.1 |
3.15.1 |
— |
| 🟠 high |
CVE-2026-73088 |
browserslist |
<= 4.28.6 |
4.28.7 |
— |
| 🟠 high |
CVE-2026-84375 |
js-yaml |
>= 4.0.0, < 4.3.2 |
4.3.2 |
— |
| 🟠 high |
CVE-2026-77078 |
multer |
< 2.3.0 |
2.3.0 |
— |
| 🟠 high |
CVE-2026-82333 |
multer |
< 2.3.0 |
2.3.0 |
— |
| 🟡 medium |
CVE-2026-33750 |
brace-expansion |
>= 2.0.0, < 2.0.3 |
2.0.3 |
— |
| 🟡 medium |
CVE-2026-2950 |
lodash |
<= 4.17.23 |
4.18.0 |
— |
| 🟡 medium |
CVE-2026-35515 |
@nestjs/core |
<= 11.1.17 |
11.1.18 |
— |
| 🟡 medium |
GHSA-r4q5-vmmm-2653 |
follow-redirects |
<= 1.15.11 |
1.16.0 |
— |
| 🟡 medium |
CVE-2026-40175 |
axios |
< 0.31.0 |
0.31.0 |
— |
| 🟡 medium |
CVE-2025-62718 |
axios |
< 0.31.0 |
0.31.0 |
— |
| 🟡 medium |
CVE-2026-42041 |
axios |
<= 0.31.0 |
0.31.1 |
— |
| 🟡 medium |
CVE-2026-42042 |
axios |
<= 0.31.0 |
0.31.1 |
— |
| 🟡 medium |
CVE-2026-42036 |
axios |
<= 0.31.0 |
0.31.1 |
— |
| 🟡 medium |
CVE-2026-42039 |
axios |
<= 0.31.0 |
0.31.1 |
— |
| 🟡 medium |
CVE-2026-42034 |
axios |
<= 0.31.0 |
0.31.1 |
— |
| 🟡 medium |
CVE-2026-42038 |
axios |
<= 0.31.0 |
0.31.1 |
— |
| 🟡 medium |
CVE-2026-34043 |
serialize-javascript |
>= 5.0.0, < 7.0.5 |
7.0.5 |
— |
| 🟡 medium |
CVE-2026-44490 |
axios |
<= 0.31.1 |
0.32.0 |
— |
| 🟡 medium |
CVE-2026-53550 |
js-yaml |
>= 4.0.0, <= 4.1.1 |
4.2.0 |
— |
| 🟡 medium |
CVE-2026-67316 |
axios |
< 0.33.0 |
0.33.0 |
— |
| 🟡 medium |
CVE-2026-67319 |
axios |
>= 0.8.0, < 0.33.0 |
0.33.0 |
— |
| 🟡 medium |
CVE-2026-82417 |
qs |
>= 2.2.5, < 6.16.0 |
6.16.0 |
— |
| 🔵 low |
CVE-2026-42040 |
axios |
<= 0.31.0 |
0.31.1 |
— |
| 🔵 low |
CVE-2026-49356 |
@babel/core |
<= 7.29.0 |
7.29.6 |
— |
| 🔵 low |
CVE-2026-12590 |
body-parser |
< 1.20.6 |
1.20.6 |
— |
| 🔵 low |
CVE-2026-77063 |
multer |
< 2.3.0 |
2.3.0 |
— |
Code Scanning Alerts
No open code scanning alerts.
Secret Scanning Alerts
No open secret scanning alerts.
🔒 Security Alerts — IBM/template-node-typescript
Attention: (no direct admin collaborators assigned to this repo — please add an admin to receive security notifications)
Dependabot Alerts
Code Scanning Alerts
No open code scanning alerts.
Secret Scanning Alerts
No open secret scanning alerts.