🔒 [IBM OSPO Security Notification] — IBM/onboarding-osb-node
Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.
SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.
💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.
📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.
Attention: @balazs-marjan @bgazsiatibm
Dependabot Alerts
| Severity |
CVE/GHSA |
Package |
Affected |
Patched |
Deadline |
Fix PR |
| 🟠 high |
CVE-2026-18446 |
fast-uri |
>= 3.0.0, < 3.1.5 |
3.1.5 |
2026-10-11 |
— |
| 🟠 high |
GHSA-5p4m-2wfm-xmqj |
js-yaml |
>= 4.0.0, < 4.3.1 |
4.3.1 |
2026-10-11 |
— |
| 🟠 high |
CVE-2026-75899 |
fast-uri |
>= 3.1.2, < 3.1.6 |
3.1.6 |
2026-10-11 |
— |
| 🟠 high |
CVE-2026-75931 |
fast-uri |
>= 3.1.3, < 3.1.6 |
3.1.6 |
2026-10-11 |
— |
| 🟠 high |
CVE-2026-75975 |
fast-uri |
>= 3.0.0, < 3.1.6 |
3.1.6 |
2026-10-11 |
— |
| 🟠 high |
CVE-2026-76172 |
fast-uri |
>= 3.0.0, < 3.1.6 |
3.1.6 |
2026-10-11 |
— |
| 🟠 high |
CVE-2026-77037 |
multer |
= 2.2.0 |
2.3.0 |
2026-10-10 |
— |
| 🟠 high |
CVE-2026-77078 |
multer |
< 2.3.0 |
2.3.0 |
2026-10-11 |
— |
| 🟠 high |
CVE-2026-82333 |
multer |
< 2.3.0 |
2.3.0 |
2026-10-11 |
— |
| 🟠 high |
CVE-2026-84375 |
js-yaml |
>= 4.0.0, < 4.3.2 |
4.3.2 |
2026-10-14 |
— |
| 🟡 medium |
CVE-2026-82562 |
qs |
>= 6.14.2, <= 6.15.3 |
6.16.0 |
2026-12-10 |
— |
| 🟡 medium |
CVE-2026-82417 |
qs |
>= 2.2.5, < 6.16.0 |
6.16.0 |
2026-12-09 |
— |
| 🟡 medium |
CVE-2026-84373 |
@vitest/mocker |
>= 2.1.0, < 4.1.11 |
4.1.11 |
2026-12-09 |
— |
| 🔵 low |
CVE-2026-77063 |
multer |
< 2.3.0 |
2.3.0 |
— |
— |
Code Scanning Alerts
No open code scanning alerts.
Secret Scanning Alerts
No open secret scanning alerts.
🔒 [IBM OSPO Security Notification] — IBM/onboarding-osb-node
Attention: @balazs-marjan @bgazsiatibm
Dependabot Alerts
Code Scanning Alerts
No open code scanning alerts.
Secret Scanning Alerts
No open secret scanning alerts.