[VANTA] [VULNERABILITY] <HIGH> CVE-2026-13697, CVE-2026-14643, CVE-2026-15157 and others, fix before 2026-09-03

> [!IMPORTANT]
> CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.
>
> DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

`npm-undici >= 7.0.0, < 7.29.0` CODE_REPOSITORY/mfe-cart <ins>CVE-2026-13697</ins> **HIGH** remediate by: 2026-09-03T11:49:14.791Z
- https://github.com/commercelayer/mfe-cart/security/dependabot/196

> <details><summary>Related URLs</summary>
> 
> - https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272
> - https://nvd.nist.gov/vuln/detail/CVE-2026-13697
> - https://github.com/nodejs/undici/commit/4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451
> - https://cna.openjsf.org/security-advisories.html
> - https://github.com/nodejs/undici/releases/tag/v7.29.0
> - https://github.com/nodejs/undici/releases/tag/v8.9.0
> - https://github.com/advisories/GHSA-4cwx-7wf7-3272
> 
> </details>

`npm-undici >= 7.0.0, < 7.29.0` CODE_REPOSITORY/mfe-cart <ins>CVE-2026-14643</ins> **MEDIUM** remediate by: 2026-10-03T11:49:15.037Z
- https://github.com/commercelayer/mfe-cart/security/dependabot/197

> <details><summary>Related URLs</summary>
> 
> - https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54
> - https://nvd.nist.gov/vuln/detail/CVE-2026-14643
> - https://github.com/nodejs/undici/commit/85a240551c9feb8b8a0ecc56c84b2b3015add8a9
> - https://github.com/nodejs/undici/commit/cb105d7c79069150982fa11acada0dd94a60dbbc
> - https://cna.openjsf.org/security-advisories.html
> - https://github.com/nodejs/undici/releases/tag/v7.29.0
> - https://github.com/nodejs/undici/releases/tag/v8.9.0
> - https://github.com/advisories/GHSA-jr45-8vmc-qm54
> 
> </details>

`npm-undici >= 7.0.0, < 7.29.0` CODE_REPOSITORY/mfe-cart <ins>CVE-2026-16728</ins> **MEDIUM** remediate by: 2026-10-03T11:49:15.037Z
- https://github.com/commercelayer/mfe-cart/security/dependabot/195

> <details><summary>Related URLs</summary>
> 
> - https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524
> - https://nvd.nist.gov/vuln/detail/CVE-2026-16728
> - https://github.com/nodejs/undici/commit/1b5a5312c3a7d7a30c31bf0d000b39a8a2531e1c
> - https://github.com/nodejs/undici/commit/2b3f749336d356bbbc50192f87f6cf7bc714721a
> - https://github.com/nodejs/undici/commit/4a9dafb16ff43880cf590e6d9c2aeee25fbff6d7
> - https://github.com/nodejs/undici/commit/4fd5a0c61e627f928b7003adc4ffe1e55ec63420
> - https://github.com/nodejs/undici/commit/cba3a52ac2e7abcc4e656d82af8579ea82c2bb9e
> - https://github.com/nodejs/undici/commit/e11a68ed4ff345c79402476f7a00d473443e318d
> - https://hackerone.com/reports/3828685
> - https://cna.openjsf.org/security-advisories.html
> - https://github.com/nodejs/undici/releases/tag/v6.28.0
> - https://github.com/nodejs/undici/releases/tag/v7.29.0
> - https://github.com/nodejs/undici/releases/tag/v8.9.0
> - https://github.com/advisories/GHSA-8xcm-r25x-g524
> 
> </details>

`npm-undici >= 7.0.0, < 7.29.0` CODE_REPOSITORY/mfe-cart <ins>CVE-2026-16729</ins> **MEDIUM** remediate by: 2026-10-03T11:49:15.037Z
- https://github.com/commercelayer/mfe-cart/security/dependabot/198

> <details><summary>Related URLs</summary>
> 
> - https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm
> - https://nvd.nist.gov/vuln/detail/CVE-2026-16729
> - https://github.com/nodejs/undici/commit/10d93fc332f2c8c161982dec3833201de29891b5
> - https://github.com/nodejs/undici/commit/3bf91ddb493e853957f3a58e155326a668ab8aef
> - https://github.com/nodejs/undici/commit/af7484043ee075a6f216da0ad77e1dac55199235
> - https://cna.openjsf.org/security-advisories.html
> - https://github.com/nodejs/undici/releases/tag/v6.28.0
> - https://github.com/nodejs/undici/releases/tag/v7.29.0
> - https://github.com/nodejs/undici/releases/tag/v8.9.0
> - https://github.com/advisories/GHSA-v3r7-h72x-cjcm
> 
> </details>

`npm-undici >= 7.0.0, < 7.29.0` CODE_REPOSITORY/mfe-cart <ins>CVE-2026-15157</ins> **MEDIUM** remediate by: 2026-10-03T11:49:15.037Z
- https://github.com/commercelayer/mfe-cart/security/dependabot/199

> <details><summary>Related URLs</summary>
> 
> - https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5
> - https://nvd.nist.gov/vuln/detail/CVE-2026-15157
> - https://github.com/nodejs/undici/commit/33928bc24f742ea8422ed90d17f2e0cc83e4d09d
> - https://github.com/nodejs/undici/commit/740a0b7c173cb4a83a5b693e96e8f3a116cfc400
> - https://github.com/nodejs/undici/commit/7d3cf924c262c486bc77f951348f4e5c847b7b42
> - https://cna.openjsf.org/security-advisories.html
> - https://github.com/nodejs/undici/releases/tag/v6.28.0
> - https://github.com/nodejs/undici/releases/tag/v7.29.0
> - https://github.com/nodejs/undici/releases/tag/v8.9.0
> - https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
> 
> </details>

`npm-nanoid < 3.3.16` CODE_REPOSITORY/mfe-cart <ins>CVE-2026-67214</ins> **HIGH** remediate by: 2026-09-11T11:40:05.644Z
- https://github.com/commercelayer/mfe-cart/security/dependabot/208

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2026-67214
> - https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49
> - https://github.com/ai/nanoid/releases/tag/5.1.16
> - https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
> - https://github.com/ai/nanoid/pull/600
> - https://github.com/ai/nanoid/pull/601
> - https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d
> - https://github.com/advisories/GHSA-28wg-ghj8-5hjv
> 
> </details>

`npm-postcss <= 8.5.17` CODE_REPOSITORY/mfe-cart <ins>CVE-2026-73646</ins> **HIGH** remediate by: 2026-09-12T19:44:52.657Z
- https://github.com/commercelayer/mfe-cart/security/dependabot/191

> <details><summary>Related URLs</summary>
> 
> - https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849
> - https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c
> - https://github.com/postcss/postcss/releases/tag/8.5.18
> - https://github.com/advisories/GHSA-r28c-9q8g-f849
> 
> </details>

`npm-nanoid < 3.3.18` CODE_REPOSITORY/mfe-cart <ins>CVE-2026-67213</ins> **HIGH** remediate by: 2026-09-16T03:44:55.340Z
- https://github.com/commercelayer/mfe-cart/security/dependabot/210

> <details><summary>Related URLs</summary>
> 
> - https://nvd.nist.gov/vuln/detail/CVE-2026-67213
> - https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7
> - https://github.com/ai/nanoid/releases/tag/5.1.6
> - https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom
> - https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b
> - https://github.com/ai/nanoid/releases/tag/3.3.17
> - https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0
> - https://github.com/ai/nanoid/releases/tag/3.3.18
> - https://github.com/advisories/GHSA-2v37-7h3g-55p8
> 
> </details>

`npm-postcss <= 8.5.22` CODE_REPOSITORY/mfe-cart <ins>CVE-2026-69153</ins> **MEDIUM** remediate by: 2026-10-11T11:40:05.964Z
- https://github.com/commercelayer/mfe-cart/security/dependabot/209

> <details><summary>Related URLs</summary>
> 
> - https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp
> - https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
> - https://github.com/postcss/postcss/releases/tag/8.5.19
> - https://github.com/advisories/GHSA-fxqj-rqcc-2cmp
> 
> </details>



Navigation Menu

[VANTA] [VULNERABILITY] <HIGH> CVE-2026-13697, CVE-2026-14643, CVE-2026-15157 and others, fix before 2026-09-03 #136

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[VANTA] [VULNERABILITY] <HIGH> CVE-2026-13697, CVE-2026-14643, CVE-2026-15157 and others, fix before 2026-09-03 #136

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions