Repository navigation
Dependencies with HIGH vulnerabilities #10093
Description
When I scan a Docker image containing an up-to-date version of npm using Trivy, I often get reports of vulnerabilities that I cannot fix.
/ # npm -g -v
12.2.0
/ # npm -g ls ip-address
/usr/local/lib
`-- npm@12.2.0
`-- make-fetch-happen@16.0.1
`-- @npmcli/agent@5.0.2
`-- socks-proxy-agent@10.1.0
`-- socks@2.8.9
`-- ip-address@10.5.0
### CVE-2026-101910, CVE-2026-101911, CVE-2026-101912, CVE-2026-101913 (MEDIUM)
/ # npm -g ls brace-expansion
/usr/local/lib
`-- npm@12.2.0
`-- minimatch@10.2.5
`-- brace-expansion@5.0.9
### CVE-2026-102276, CVE-2026-102277, CVE-2026-102278 (HIGH)
/ # npm -g ls postcss-selector-parser
/usr/local/lib
`-- npm@12.2.0
`-- @npmcli/arborist@10.0.3
`-- @npmcli/query@5.0.0
`-- postcss-selector-parser@7.1.4 (MEDIUM)
### CVE-2026-104844 (MEDIUM)
/ # npm -g ls undici
/usr/local/lib
`-- npm@12.2.0
`-- node-gyp@13.0.0
`-- undici@6.28.0
### CVE-2026-19534, CVE-2026-85024, CVE-2026-18540 (HIGH)
The latest version contains dependencies with 11 vulnerabilities (3 HIGH, 7 MEDIUM, 1 LOW).
I cannot apply these existing fixes using npm -g audit fix.
Is there a solution, or do we have to wait for the NPM fix?
Could you publish a version that addresses these vulnerabilities HIGH ?
Activity
[-]Dependency with HIGH vulnerability[/-][+]Dependencies with HIGH vulnerabilities[/+]v-kchindam-infy commentedon Oct 13, 2026
Closing: this looks to be similar if not a duplicate of an existing issue, #10062. If you believe your instance is unique, please provide further clarifying details.