{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "miniflare": {
      "name": "miniflare",
      "severity": "high",
      "isDirect": false,
      "via": [
        "sharp",
        "undici"
      ],
      "effects": [
        "wrangler"
      ],
      "range": "<=0.0.0-fec45ed61 || 4.20250508.3 - 5.20261006.0-alpha",
      "nodes": [
        "node_modules/miniflare"
      ],
      "fixAvailable": true
    },
    "sharp": {
      "name": "sharp",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1241331,
          "name": "sharp",
          "dependency": "sharp",
          "title": "sharp : Vulnerability in librsvg dependency CVE-2026-96889",
          "url": "https://github.com/advisories/GHSA-wq5f-xc86-pv6w",
          "severity": "high",
          "cwe": [
            "CWE-416",
            "CWE-1395"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<0.35.5"
        }
      ],
      "effects": [
        "miniflare"
      ],
      "range": "<0.35.5",
      "nodes": [
        "node_modules/sharp"
      ],
      "fixAvailable": true
    },
    "source-map-js": {
      "name": "source-map-js",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1241209,
          "name": "source-map-js",
          "dependency": "source-map-js",
          "title": "source-map-js allows event-loop denial of service through indexed source-map section offsets",
          "url": "https://github.com/advisories/GHSA-68fv-2mgg-jv7q",
          "severity": "high",
          "cwe": [
            "CWE-1284"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=1.0.0 <1.2.2"
        }
      ],
      "effects": [],
      "range": "1.0.0 - 1.2.1",
      "nodes": [
        "node_modules/source-map-js"
      ],
      "fixAvailable": true
    },
    "undici": {
      "name": "undici",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1239933,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression",
          "url": "https://github.com/advisories/GHSA-3wwx-pv8p-q78v",
          "severity": "moderate",
          "cwe": [
            "CWE-248"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.28.0 <7.29.1"
        },
        {
          "source": 1240036,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to Denial of Service via orphaned RetryHandler response body",
          "url": "https://github.com/advisories/GHSA-pmjh-fq2x-6v4x",
          "severity": "moderate",
          "cwe": [
            "CWE-772"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.11.0 <7.29.1"
        },
        {
          "source": 1240038,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to downstream response splitting via retry interceptor",
          "url": "https://github.com/advisories/GHSA-r53p-7pc4-xj5r",
          "severity": "low",
          "cwe": [
            "CWE-444"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=7.0.0 <7.29.1"
        },
        {
          "source": 1240041,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to Denial of Service via unrequested WebSocket subprotocol",
          "url": "https://github.com/advisories/GHSA-rfgv-xxqx-mfg5",
          "severity": "high",
          "cwe": [
            "CWE-248",
            "CWE-252"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.0.0 <7.29.1"
        },
        {
          "source": 1240044,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to Denial of Service via unbounded decompression of compressed responses",
          "url": "https://github.com/advisories/GHSA-3xpg-4rpp-hhhm",
          "severity": "moderate",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.15.0 <7.29.1"
        },
        {
          "source": 1240046,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches",
          "url": "https://github.com/advisories/GHSA-2jfj-6hjv-fm6j",
          "severity": "moderate",
          "cwe": [
            "CWE-200",
            "CWE-524"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N"
          },
          "range": ">=7.0.0 <7.29.1"
        },
        {
          "source": 1240048,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to response truncation via oversized chunked responses in the dump interceptor",
          "url": "https://github.com/advisories/GHSA-2gqq-gqf2-x968",
          "severity": "low",
          "cwe": [
            "CWE-20",
            "CWE-248"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=7.1.0 <7.29.1"
        },
        {
          "source": 1240050,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool",
          "url": "https://github.com/advisories/GHSA-w293-vg96-wgc3",
          "severity": "high",
          "cwe": [
            "CWE-295"
          ],
          "cvss": {
            "score": 7.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
          },
          "range": ">=7.24.1 <7.29.1"
        },
        {
          "source": 1240052,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to caching and replay of unsafe HTTP method responses",
          "url": "https://github.com/advisories/GHSA-8436-99hf-9mmv",
          "severity": "low",
          "cwe": [
            "CWE-345"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=7.0.0 <7.29.1"
        },
        {
          "source": 1240055,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to Denial of Service via WebSocketStream unclean close",
          "url": "https://github.com/advisories/GHSA-rx4f-c7p8-82vq",
          "severity": "moderate",
          "cwe": [
            "CWE-248",
            "CWE-754"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.0.0 <7.29.1"
        }
      ],
      "effects": [
        "miniflare"
      ],
      "range": "7.0.0 - 7.29.0",
      "nodes": [
        "node_modules/undici"
      ],
      "fixAvailable": true
    },
    "vite": {
      "name": "vite",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1242626,
          "name": "vite",
          "dependency": "vite",
          "title": "launch-editor: escapeCmdArgs() omits % escaping on Windows",
          "url": "https://github.com/advisories/GHSA-698v-4r3x-3vcv",
          "severity": "moderate",
          "cwe": [
            "CWE-78"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=8.3.0 <=8.3.2"
        },
        {
          "source": 1242655,
          "name": "vite",
          "dependency": "vite",
          "title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors",
          "url": "https://github.com/advisories/GHSA-r825-w8mm-5pxw",
          "severity": "moderate",
          "cwe": [
            "CWE-88"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=8.3.0 <=8.3.2"
        },
        {
          "source": 1242662,
          "name": "vite",
          "dependency": "vite",
          "title": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows",
          "url": "https://github.com/advisories/GHSA-587h-7wmj-h5pm",
          "severity": "high",
          "cwe": [
            "CWE-77"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=8.3.0 <=8.3.2"
        },
        {
          "source": 1242728,
          "name": "vite",
          "dependency": "vite",
          "title": "Vite: Cross origin script execution through Vite custom middleware",
          "url": "https://github.com/advisories/GHSA-9jrq-w75r-8gcw",
          "severity": "low",
          "cwe": [
            "CWE-80"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=8.3.0 <=8.3.2"
        },
        {
          "source": 1242734,
          "name": "vite",
          "dependency": "vite",
          "title": "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine",
          "url": "https://github.com/advisories/GHSA-rq7h-c2jc-7f22",
          "severity": "moderate",
          "cwe": [
            "CWE-22",
            "CWE-284"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=8.3.0 <=8.3.2"
        },
        {
          "source": 1242737,
          "name": "vite",
          "dependency": "vite",
          "title": "Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`",
          "url": "https://github.com/advisories/GHSA-vfpm-58rq-9qcg",
          "severity": "moderate",
          "cwe": [
            "CWE-22",
            "CWE-200",
            "CWE-209"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=8.3.0 <=8.3.2"
        }
      ],
      "effects": [],
      "range": "8.3.0 - 8.3.2",
      "nodes": [
        "node_modules/vite"
      ],
      "fixAvailable": true
    },
    "wrangler": {
      "name": "wrangler",
      "severity": "high",
      "isDirect": true,
      "via": [
        "miniflare"
      ],
      "effects": [],
      "range": "<=0.0.0-7ae5dd357 || 4.16.0 - 4.148.0",
      "nodes": [
        "node_modules/wrangler"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 0,
      "high": 6,
      "critical": 0,
      "total": 6
    },
    "dependencies": {
      "prod": 58,
      "dev": 61,
      "optional": 86,
      "peer": 0,
      "peerOptional": 0,
      "total": 173
    }
  }
}