Skip to content

react-native-0.84.0.tgz: 13 vulnerabilities (highest severity is: 9.8) #228

Open
Open
react-native-0.84.0.tgz: 13 vulnerabilities (highest severity is: 9.8)#228
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend
@mend-for-github-com

Description

@mend-for-github-com
mend-for-github-com
bot
opened on Mar 3, 2026
Vulnerable Library - react-native-0.84.0.tgz

Path to dependency file: /MultipartyNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/fast-xml-parser/package.json,/MultipartyNewArchitecture/node_modules/fast-xml-parser/package.json

Vulnerabilities

Vulnerability Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (react-native version) Remediation Possible** Reachability
CVE-2025-11953 Critical 9.8 High 22.379% detected in multiple dependencies Transitive 0.84.1 ✅

Unreachable
CVE-2026-33671 High 7.5 Not Defined 0.019% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2026-33036 High 7.5 Not Defined 0.027% fast-xml-parser-4.5.4.tgz Transitive N/A* ❌

Unreachable
CVE-2026-33750 Medium 6.5 Not Defined 0.024% brace-expansion-1.1.12.tgz Transitive N/A* ❌

Unreachable
CVE-2026-33349 Medium 5.9 Not Defined 0.046% fast-xml-parser-4.5.4.tgz Transitive N/A* ❌

Unreachable
CVE-2026-33672 Medium 5.3 Not Defined 0.057% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2026-33532 Medium 4.3 Not Defined 0.022% yaml-2.8.2.tgz Transitive N/A* ❌

Unreachable
CVE-2026-25896 Critical 9.3 Not Defined 0.02% fast-xml-parser-4.5.4.tgz Transitive N/A* ❌
CVE-2026-9277 High 8.1 Not Defined 0.068% shell-quote-1.8.3.tgz Transitive N/A* ❌
CVE-2026-26278 High 7.5 Not Defined 0.032% fast-xml-parser-4.5.4.tgz Transitive N/A* ❌
CVE-2026-41650 Medium 6.1 Not Defined 0.012% fast-xml-parser-4.5.4.tgz Transitive 0.84.1 ✅
CVE-2026-8723 Medium 5.3 Not Defined 0.044% qs-6.14.2.tgz Transitive 0.84.1 ✅
CVE-2026-27942 Medium 5.3 Not Defined 0.018% fast-xml-parser-4.5.4.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2025-11953

Vulnerable Libraries - cli-18.0.0.tgz, cli-server-api-18.0.0.tgz

cli-18.0.0.tgz

React Native CLI

Library home page: https://registry.npmjs.org/@⁠react-native-community/cli/-/cli-18.0.0.tgz

Path to dependency file: /Archiving/package.json

Path to vulnerable library: /Archiving/node_modules/@⁠react-native-community/cli/package.json,/ArchivingNewArchitecture/node_modules/@⁠react-native-community/cli/package.json,/BackgroundBlur/node_modules/@⁠react-native-community/cli/package.json,/BasicVideoChat/node_modules/@⁠react-native-community/cli/package.json,/BasicVideoChatNewArchitecture/node_modules/@⁠react-native-community/cli/package.json,/Multiparty/node_modules/@⁠react-native-community/cli/package.json,/MultipartyNewArchitecture/node_modules/@⁠react-native-community/cli/package.json,/ScreenSharing/node_modules/@⁠react-native-community/cli/package.json,/Signaling/node_modules/@⁠react-native-community/cli/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • community-cli-plugin-0.84.0.tgz
      • ❌ cli-18.0.0.tgz (Vulnerable Library)

cli-server-api-18.0.0.tgz

Library home page: https://registry.npmjs.org/@⁠react-native-community/cli-server-api/-/cli-server-api-18.0.0.tgz

Path to dependency file: /Archiving/package.json

Path to vulnerable library: /Archiving/node_modules/@⁠react-native-community/cli-server-api/package.json,/ArchivingNewArchitecture/node_modules/@⁠react-native-community/cli-server-api/package.json,/BackgroundBlur/node_modules/@⁠react-native-community/cli-server-api/package.json,/BasicVideoChat/node_modules/@⁠react-native-community/cli-server-api/package.json,/BasicVideoChatNewArchitecture/node_modules/@⁠react-native-community/cli-server-api/package.json,/Multiparty/node_modules/@⁠react-native-community/cli-server-api/package.json,/MultipartyNewArchitecture/node_modules/@⁠react-native-community/cli-server-api/package.json,/ScreenSharing/node_modules/@⁠react-native-community/cli-server-api/package.json,/Signaling/node_modules/@⁠react-native-community/cli-server-api/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • community-cli-plugin-0.84.0.tgz
      • cli-18.0.0.tgz
        • ❌ cli-server-api-18.0.0.tgz (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-11-03

URL: CVE-2025-11953

Threat Assessment

Exploit Maturity: High

EPSS: 22.379%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-399j-vxmf-hjvr

Release Date: 2025-11-03

Fix Resolution (@⁠react-native-community/cli): 18.0.1

Direct dependency fix Resolution (react-native): 0.84.1

Fix Resolution (@⁠react-native-community/cli-server-api): 18.0.1

Direct dependency fix Resolution (react-native): 0.84.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-33671

Vulnerable Libraries - picomatch-4.0.3.tgz, picomatch-2.3.1.tgz

picomatch-4.0.3.tgz

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Library home page: https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz

Path to dependency file: /MultipartyNewArchitecture/package.json

Path to vulnerable library: /MultipartyNewArchitecture/node_modules/tinyglobby/node_modules/picomatch/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • tinyglobby-0.2.15.tgz
      • ❌ picomatch-4.0.3.tgz (Vulnerable Library)

picomatch-2.3.1.tgz

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Library home page: https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz

Path to dependency file: /Archiving/package.json

Path to vulnerable library: /Archiving/node_modules/picomatch/package.json,/ArchivingNewArchitecture/node_modules/picomatch/package.json,/BackgroundBlur/node_modules/picomatch/package.json,/BasicVideoChat/node_modules/picomatch/package.json,/BasicVideoChatNewArchitecture/node_modules/picomatch/package.json,/Multiparty/node_modules/picomatch/package.json,/MultipartyNewArchitecture/node_modules/picomatch/package.json,/ScreenSharing/node_modules/picomatch/package.json,/Signaling/node_modules/picomatch/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • jest-environment-node-29.7.0.tgz
      • jest-util-29.7.0.tgz
        • ❌ picomatch-2.3.1.tgz (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as "+()" and "()", especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to "picomatch" for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to "picomatch". Possible mitigations include disabling extglob support for untrusted patterns by using "noextglob: true", rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as "+()" and "()", enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.

Publish Date: 2026-03-26

URL: CVE-2026-33671

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.019%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-25

Fix Resolution: https://github.com/micromatch/picomatch.git - 3.0.2,https://github.com/micromatch/picomatch.git - 4.0.4,https://github.com/micromatch/picomatch.git - 2.3.2

CVE-2026-33036

Vulnerable Library - fast-xml-parser-4.5.4.tgz

Validate XML, Parse XML, Build XML without C/C++ based libraries

Library home page: https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.5.4.tgz

Path to dependency file: /ArchivingNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/fast-xml-parser/package.json,/MultipartyNewArchitecture/node_modules/fast-xml-parser/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • community-cli-plugin-0.84.0.tgz
      • cli-18.0.0.tgz
        • cli-doctor-18.0.0.tgz
          • cli-platform-apple-18.0.0.tgz
            • ❌ fast-xml-parser-4.5.4.tgz (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like A can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process—even when developers have configured strict limits. This issue has been fixed in version 5.5.6.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-03-20

URL: CVE-2026-33036

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.027%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8gc5-j5rx-235r

Release Date: 2026-03-18

Fix Resolution: https://github.com/NaturalIntelligence/fast-xml-parser.git - v5.5.6

CVE-2026-33750

Vulnerable Library - brace-expansion-1.1.12.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz

Path to dependency file: /ArchivingNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/glob/node_modules/brace-expansion/package.json,/ArchivingNewArchitecture/node_modules/test-exclude/node_modules/brace-expansion/package.json,/BasicVideoChatNewArchitecture/node_modules/glob/node_modules/brace-expansion/package.json,/BasicVideoChatNewArchitecture/node_modules/test-exclude/node_modules/brace-expansion/package.json,/MultipartyNewArchitecture/node_modules/glob/node_modules/brace-expansion/package.json,/MultipartyNewArchitecture/node_modules/test-exclude/node_modules/brace-expansion/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • babel-jest-29.7.0.tgz
      • babel-plugin-istanbul-6.1.1.tgz
        • test-exclude-6.0.0.tgz
          • minimatch-3.1.5.tgz
            • ❌ brace-expansion-1.1.12.tgz (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., "{1..2..0}") causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to "expand()" to ensure a step value of "0" is not used.

Publish Date: 2026-03-27

URL: CVE-2026-33750

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.024%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-27

Fix Resolution: https://github.com/juliangruber/brace-expansion.git - v2.0.3,https://github.com/juliangruber/brace-expansion.git - v3.0.2,https://github.com/juliangruber/brace-expansion.git - v5.0.5,https://github.com/juliangruber/brace-expansion.git - v1.1.13

CVE-2026-33349

Vulnerable Library - fast-xml-parser-4.5.4.tgz

Validate XML, Parse XML, Build XML without C/C++ based libraries

Library home page: https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.5.4.tgz

Path to dependency file: /ArchivingNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/fast-xml-parser/package.json,/MultipartyNewArchitecture/node_modules/fast-xml-parser/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • community-cli-plugin-0.84.0.tgz
      • cli-18.0.0.tgz
        • cli-doctor-18.0.0.tgz
          • cli-platform-apple-18.0.0.tgz
            • ❌ fast-xml-parser-4.5.4.tgz (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer explicitly sets either limit to 0 — intending to disallow all entities or restrict entity size to zero bytes — the falsy nature of 0 in JavaScript causes the guard conditions to short-circuit, completely bypassing the limits. An attacker who can supply XML input to such an application can trigger unbounded entity expansion, leading to memory exhaustion and denial of service. This issue has been patched in version 5.5.7.

Publish Date: 2026-03-24

URL: CVE-2026-33349

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.046%

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jp2q-39xq-3w4g

Release Date: 2026-03-19

Fix Resolution: fast-xml-parser - 5.5.7,fast-xml-parser - 4.5.5

CVE-2026-33672

Vulnerable Libraries - picomatch-2.3.1.tgz, picomatch-4.0.3.tgz

picomatch-2.3.1.tgz

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Library home page: https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz

Path to dependency file: /Archiving/package.json

Path to vulnerable library: /Archiving/node_modules/picomatch/package.json,/ArchivingNewArchitecture/node_modules/picomatch/package.json,/BackgroundBlur/node_modules/picomatch/package.json,/BasicVideoChat/node_modules/picomatch/package.json,/BasicVideoChatNewArchitecture/node_modules/picomatch/package.json,/Multiparty/node_modules/picomatch/package.json,/MultipartyNewArchitecture/node_modules/picomatch/package.json,/ScreenSharing/node_modules/picomatch/package.json,/Signaling/node_modules/picomatch/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • jest-environment-node-29.7.0.tgz
      • jest-util-29.7.0.tgz
        • ❌ picomatch-2.3.1.tgz (Vulnerable Library)

picomatch-4.0.3.tgz

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Library home page: https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz

Path to dependency file: /MultipartyNewArchitecture/package.json

Path to vulnerable library: /MultipartyNewArchitecture/node_modules/tinyglobby/node_modules/picomatch/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • tinyglobby-0.2.15.tgz
      • ❌ picomatch-4.0.3.tgz (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the "POSIX_REGEX_SOURCE" object. Because the object inherits from "Object.prototype", specially crafted POSIX bracket expressions (e.g., "[[:constructor:]]") can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected "picomatch" versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like "[[:...:]]"; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying "POSIX_REGEX_SOURCE" to use a null prototype.

Publish Date: 2026-03-26

URL: CVE-2026-33672

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.057%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-25

Fix Resolution: https://github.com/micromatch/picomatch.git - 2.3.2,https://github.com/micromatch/picomatch.git - 4.0.4,https://github.com/micromatch/picomatch.git - 3.0.2

CVE-2026-33532

Vulnerable Library - yaml-2.8.2.tgz

JavaScript parser and stringifier for YAML

Library home page: https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz

Path to dependency file: /ArchivingNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/yaml/package.json,/BasicVideoChatNewArchitecture/node_modules/yaml/package.json,/MultipartyNewArchitecture/node_modules/yaml/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • community-cli-plugin-0.84.0.tgz
      • cli-18.0.0.tgz
        • cli-doctor-18.0.0.tgz
          • ❌ yaml-2.8.2.tgz (Vulnerable Library)

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

"yaml" is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of "yaml" on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a "RangeError: Maximum call stack size exceeded" with a small payload (~2–10 KB). The "RangeError" is not a "YAMLParseError", so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one "[" and one "]"). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's "Parser" (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: "YAML.parse()", "YAML.parseDocument()", and "YAML.parseAllDocuments()". Versions 1.10.3 and 2.8.3 contain a patch.

Publish Date: 2026-03-26

URL: CVE-2026-33532

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.022%

CVSS 3 Score Details (4.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-25

Fix Resolution: https://github.com/eemeli/yaml.git - v1.10.3,https://github.com/eemeli/yaml.git - v2.8.3

CVE-2026-25896

Vulnerable Library - fast-xml-parser-4.5.4.tgz

Validate XML, Parse XML, Build XML without C/C++ based libraries

Library home page: https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.5.4.tgz

Path to dependency file: /ArchivingNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/fast-xml-parser/package.json,/MultipartyNewArchitecture/node_modules/fast-xml-parser/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • community-cli-plugin-0.84.0.tgz
      • cli-18.0.0.tgz
        • cli-doctor-18.0.0.tgz
          • cli-platform-apple-18.0.0.tgz
            • ❌ fast-xml-parser-4.5.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-02-20

URL: CVE-2026-25896

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.02%

CVSS 3 Score Details (9.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-02-20

Fix Resolution: https://github.com/NaturalIntelligence/fast-xml-parser.git - v5.3.5

CVE-2026-9277

Vulnerable Library - shell-quote-1.8.3.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz

Path to dependency file: /ArchivingNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/shell-quote/package.json,/BasicVideoChatNewArchitecture/node_modules/shell-quote/package.json,/MultipartyNewArchitecture/node_modules/shell-quote/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • community-cli-plugin-0.84.0.tgz
      • cli-18.0.0.tgz
        • cli-tools-18.0.0.tgz
          • launch-editor-2.13.1.tgz
            • ❌ shell-quote-1.8.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

shell-quote's "quote()" function did not validate object-token inputs against the operator model used by "parse()". The ".op" field was backslash-escaped character by character using "/(.)/g", which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in ".op" therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of "{ op: '...\n...' }" from external input, and (2) via "parse(cmd, envFn)" when "envFn" returns object tokens whose ".op" is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: ".op" must match the parser's control-operator allowlist; "{ op: 'glob', pattern }" validates "pattern" and forbids line terminators; "{ comment }" validates "comment" and forbids line terminators; any other object shape throws "TypeError".

Publish Date: 2026-05-22

URL: CVE-2026-9277

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.068%

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-22

Fix Resolution: https://github.com/ljharb/shell-quote.git - v1.8.4,shell-quote - 1.8.4

CVE-2026-26278

Vulnerable Library - fast-xml-parser-4.5.4.tgz

Validate XML, Parse XML, Build XML without C/C++ based libraries

Library home page: https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.5.4.tgz

Path to dependency file: /ArchivingNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/fast-xml-parser/package.json,/MultipartyNewArchitecture/node_modules/fast-xml-parser/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • community-cli-plugin-0.84.0.tgz
      • cli-18.0.0.tgz
        • cli-doctor-18.0.0.tgz
          • cli-platform-apple-18.0.0.tgz
            • ❌ fast-xml-parser-4.5.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by "processEntities: false" option.

Publish Date: 2026-02-19

URL: CVE-2026-26278

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.032%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jmr7-xgp7-cmfj

Release Date: 2026-02-17

Fix Resolution: https://github.com/NaturalIntelligence/fast-xml-parser.git - v5.3.6

CVE-2026-41650

Vulnerable Library - fast-xml-parser-4.5.4.tgz

Validate XML, Parse XML, Build XML without C/C++ based libraries

Library home page: https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.5.4.tgz

Path to dependency file: /ArchivingNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/fast-xml-parser/package.json,/MultipartyNewArchitecture/node_modules/fast-xml-parser/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • community-cli-plugin-0.84.0.tgz
      • cli-18.0.0.tgz
        • cli-doctor-18.0.0.tgz
          • cli-platform-apple-18.0.0.tgz
            • ❌ fast-xml-parser-4.5.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.

Publish Date: 2026-05-07

URL: CVE-2026-41650

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.012%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-04-22

Fix Resolution (fast-xml-parser): 5.7.0

Direct dependency fix Resolution (react-native): 0.84.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-8723

Vulnerable Library - qs-6.14.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.14.2.tgz

Path to dependency file: /MultipartyNewArchitecture/package.json

Path to vulnerable library: /MultipartyNewArchitecture/node_modules/qs/package.json,/ArchivingNewArchitecture/node_modules/qs/package.json,/BasicVideoChatNewArchitecture/node_modules/qs/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • community-cli-plugin-0.84.0.tgz
      • cli-18.0.0.tgz
        • cli-server-api-18.0.0.tgz
          • body-parser-1.20.4.tgz
            • ❌ qs-6.14.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Summary
"qs.stringify" throws "TypeError" when called with "arrayFormat: 'comma'" and "encodeValuesOnly: true" on an array containing "null" or "undefined". The throw is synchronous and not handled by any of qs's null-related options ("skipNulls", "strictNullHandling").
Details
In the comma + "encodeValuesOnly" branch, "lib/stringify.js:145" mapped the array through the raw encoder before joining:
obj = utils.maybeMap(obj, encoder);
"utils.encode" ("lib/utils.js:195") reads "str.length" with no null guard, so a "null" or "undefined" element throws "TypeError". "skipNulls" and "strictNullHandling" are both checked in the per-element loop below this line and never get a chance to run.
Same class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + "encodeValuesOnly" branch was introduced in 4c4b23d ("encode comma values more consistently", PR #⁠463, 2023-01-19), first released in v6.11.1.
PoC
const qs = require('qs');
qs.stringify({ a: [null, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true });
// TypeError: Cannot read properties of null (reading 'length')
// at encode (lib/utils.js:195:13)
// at Object.maybeMap (lib/utils.js:322:37)
// at stringify (lib/stringify.js:145:25)
Fix
"lib/stringify.js:145", applied in 21f80b3 on "main" and released as v6.15.2:

  • obj = utils.maybeMap(obj, encoder);
  • obj = utils.maybeMap(obj, function (v) {
  • return v == null ? v : encoder(v);
  • });
    "null" and "undefined" now pass through "maybeMap" unchanged and reach the "join(',')" step as-is. For "{ a: [null, 'b'] }" this produces "a=,b", matching the non-"encodeValuesOnly" comma path (which already joins before encoding and produces "a=%2Cb" for the same input). Single-element "[null]" arrays still collapse via the existing "obj.join(',') || null" and remain subject to "skipNulls" / "strictNullHandling" in the main loop.
    Affected versions
    ">=6.11.1 <6.15.2" — fixed in v6.15.2.
    The vulnerable code shape was introduced in 4c4b23d and first shipped in v6.11.1. Earlier versions — including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 — implemented the comma + "encodeValuesOnly" path differently (joining before encoding) and are not affected. Empirically verified across released versions.
    Impact
    Application code that calls "qs.stringify" with both "arrayFormat: 'comma'" and "encodeValuesOnly: true" (both non-default) on input that may contain a "null" or "undefined" array element will throw synchronously instead of producing a query string. In a typical Node.js HTTP framework (Express, Fastify, Koa, hapi) the sync throw is caught by the framework's error boundary and the affected request returns a 500; the worker process does not exit and subsequent requests are unaffected. The "kills the worker process" framing applies only to call sites outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or to deployments with framework error handling explicitly disabled.
    The vulnerable input is a "null" or "undefined" entry inside an array; this is reachable from JSON request bodies or from application code constructing arrays from user input, but not from standard HTML form submissions (which produce strings or omitted fields, not literal "null").
    Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-05-16

URL: CVE-2026-8723

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.044%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q8mj-m7cp-5q26

Release Date: 2026-05-16

Fix Resolution (qs): 6.15.2

Direct dependency fix Resolution (react-native): 0.84.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-27942

Vulnerable Library - fast-xml-parser-4.5.4.tgz

Validate XML, Parse XML, Build XML without C/C++ based libraries

Library home page: https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-4.5.4.tgz

Path to dependency file: /ArchivingNewArchitecture/package.json

Path to vulnerable library: /ArchivingNewArchitecture/node_modules/fast-xml-parser/package.json,/MultipartyNewArchitecture/node_modules/fast-xml-parser/package.json

Dependency Hierarchy:

  • react-native-0.84.0.tgz (Root Library)
    • community-cli-plugin-0.84.0.tgz
      • cli-18.0.0.tgz
        • cli-doctor-18.0.0.tgz
          • cli-platform-apple-18.0.0.tgz
            • ❌ fast-xml-parser-4.5.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with "preserveOrder:true". Version 5.3.8 fixes the issue. As a workaround, use XML builder with "preserveOrder:false" or check the input data before passing to builder.

Publish Date: 2026-02-26

URL: CVE-2026-27942

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.018%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-02-26

Fix Resolution: https://github.com/NaturalIntelligence/fast-xml-parser.git - v5.3.8,fast-xml-parser - 5.3.8

⛑️Automatic Remediation will be attempted for this issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions