# Named CVE watchlist (2025–2026)

Companion of `security-baseline` (OWASP 2025-A03). **Not** injected via Claude
`skills:` and **not** inlined in agents. Read this file only when a trigger
below matches the lockfile / manifest.

Do **not** invent CVE ids. Refresh this table on the next SVS release.
`npm audit` / `composer audit` / `pip-audit` stay mandatory — this list
covers waves those tools lag or miss (no CVE on the leaf package).

Checked against GitHub Advisory Database on **2026-10-13**.

## When to Read

Any of these in `package-lock.json` / `pnpm-lock.yaml` / `yarn.lock` /
`composer.lock` / `package.json` / `composer.json`:

`react` · `react-dom` · `react-server-dom-*` · `next` · `axios` ·
`react-router` · `@remix-run/react` · `laravel/framework` ·
`laravel/passport` · `livewire/livewire` · `symfony/html-sanitizer` ·
`symfony/http-client` · `@tanstack/`

Also Read on worm indicators you did not write: `preinstall` → `setup.mjs`,
`Math_Symbol.js`, unexpected hooks in `.claude/settings.json` or
`.vscode/tasks.json`.

## Table

| CVE | Sev | When it hits | Floor (fixed) |
|---|---|---|---|
| CVE-2025-55182 | CRIT | React RSC / Next App Router — `react-server-dom-*` 19.0.0, 19.1.0, 19.1.1, 19.2.0 (React2Shell Flight RCE). `CVE-2025-66478` is a **rejected duplicate** — cite 55182. First patches (19.0.1 / 19.1.2 / 19.2.1) are **not** the combined floor. | Prefer `react` / `react-dom` / `react-server-dom-*` **19.3.x**. Line floors after follow-ons: **19.0.6 / 19.1.7 / 19.2.6**. `next` ≥ latest patched on your line (see the September 2026 rows) |
| CVE-2025-55183 | MED | RSC Server Function source / secret-in-source leak on Flight endpoints | Same combined floor (`react-server-dom-*` 19.0.6 / 19.1.7 / 19.2.6 / 19.3) |
| CVE-2025-55184 | HIGH | RSC Flight DoS (hang / CPU). Incomplete first fix → also **CVE-2025-67779**, **CVE-2026-23864**, **CVE-2026-23869** | Combined floor is the 23870 row, not 19.0.5 / 19.1.6 / 19.2.5 |
| CVE-2026-23870 | HIGH | RSC Server Function DoS. 19.0.0–19.0.5, 19.1.0–19.1.6, 19.2.0–19.2.5 of `react-server-dom-*`. 19.3.x is outside this range. | **19.0.6 / 19.1.7 / 19.2.6** |
| CVE-2026-44579 | HIGH | `next` 15.x < 15.5.16 or 16.x < 16.2.5 **and** Cache Components / PPR (server-action body deadlock) | Own fix 15.5.16 or 16.2.5. Combined Next floor is the September 2026 row |
| CVE-2026-44580 | HIGH | `next` beforeInteractive script XSS when script content is untrusted | Own fix 15.5.16 or 16.2.5. Combined Next floor is the September 2026 row |
| CVE-2026-94543 | MED | Self-hosted Next Pages Router SSG/ISR cache poisoning. Vercel-hosted apps are outside this advisory. | `next` **15.5.27** or **16.3.8** |
| CVE-2026-94484 | MED | Next SSG/ISR response-cache poisoning (cross-user content) | `next` **15.5.27** or **16.3.8** |
| CVE-2026-94485 | MED | App Router metadata image routes ignore `dynamicParams` on webpack builds (16.x) | `next` **16.3.8** |
| GHSA-vcvr-r3jv-pc5j | CRIT | `next/og` Node `ImageResponse` RCE when attacker-controlled SVG is passed. No CVE id on the advisory. 15.x is outside the range. | `next` **16.3.6**; combined 16.x floor **16.3.8** |
| CVE-2026-21884 | HIGH | `react-router` 7.0–7.11 Framework Mode `<ScrollRestoration>` SSR XSS (`getKey` / `storageKey`) | `react-router` **7.12.0+**; `@remix-run/react` **2.17.3+** |
| CVE-2026-33245 | HIGH | `react-router` 7.7.0–7.13.1 unstable RSC redirect XSS | `react-router` **7.13.2+** |
| CVE-2025-27152 | HIGH | `axios` absolute URL overrides `baseURL` — SSRF / header leak | `axios` **1.8.2** / **0.30.0** (still bump — later CVEs) |
| CVE-2025-58754 | HIGH | `axios` Node `data:` URI unbounded memory | `axios` **1.12.0** / **0.30.2** |
| CVE-2026-42042 | MED | `axios` `withXSRFToken` truthy (non-boolean) skips same-origin check — XSRF cookie leaked cross-origin | First fix **1.15.1** / **0.31.1**; pin **≥ 1.20.0** |
| CVE-2025-62718 | MED | `axios` `NO_PROXY` bypass / SSRF (1.15.0 incomplete — later loopback / `0.0.0.0` follow-ons) | Pin **≥ 1.20.0** (Node adapter) |
| CVE-2026-40175 | MED | `axios` cloud-metadata exfil / proxy path | Pin **≥ 1.20.0** (Node adapter) |
| CVE-2026-101898 – CVE-2026-101909 | HIGH | Axios September 2026 wave: header injection, redirect SSRF when `maxRedirects` is 0, prototype-pollution gadgets, ReDoS, HTTP/2 adapter. Includes **CVE-2026-101902**. | Pin **≥ 1.20.0** (0.x line **0.34.0** where that line was patched) |
| CVE-2026-45321 | CRIT | Mini Shai-Hulud worm (npm + PyPI). Lockfile/`preinstall` → `setup.mjs`; unexpected `.claude/settings.json` / `.vscode/tasks.json` hooks; `@tanstack/*` versions from the May-2026 window. Contain host **before** revoke (watchdog) — `secrets-management` rotation playbook. | Pin clean versions; `npm i --ignore-scripts`; rotate from a **clean** machine |
| CVE-2026-102279 | LOW | `laravel/framework` debug-page XSS | **12.69.0** or **13.30.0** |
| GHSA-5vg9-5847-vvmq | HIGH | Laravel default email-rule CRLF injection. No CVE id on the advisory. | **12.60.0** or **13.10.0** |
| GHSA-crmm-hgp2-wgrp | MOD | Laravel temporary signed-URL path confusion. No CVE id on the advisory. | **12.61.1** or **13.12.0** |
| CVE-2026-39976 | HIGH | `laravel/passport` ≥ 13.0.0 < 13.7.1 — `client_credentials` token can resolve as a user | 13.7.1 |
| CVE-2026-81887 | MOD | `livewire/livewire` DOM XSS during client-side state handling | **3.8.3** or **4.3.4** |
| CVE-2026-45753 | HIGH | `symfony/html-sanitizer` < 6.4.40 / < 7.4.12 / < 8.0.12 — `javascript:` survives on action/formaction/poster/cite | 6.4.40 / 7.4.12 / 8.0.12 |
| CVE-2026-48736 | HIGH | `symfony/http-client` / `IpUtils` — IPv6 6to4/NAT64/Teredo bypass of private-IP SSRF block | 5.4.53 / 6.4.41 / 7.4.13 / 8.0.13 |

Worm / malware waves often have **no CVE on the leaf package** (GHSA malware /
OSV `MAL-*`). Still VETO on the indicators above.

## No advisory on 2026-10-13

These repos were checked. Do not add a CVE row for them until GitHub Advisory
publishes one.

| Package | Current | Result |
|---|---|---|
| `tailwindcss` | 4.3.3 | No GitHub security advisory |
| `inertiajs/inertia-laravel` | 3.5.1 | No GitHub security advisory |
| `@inertiajs/react` / `@inertiajs/core` | 3.9.1 | No GitHub security advisory |
| Node.js runtime | 24.21.0 LTS (Krypton). 22.23.3 still in maintenance. Last 20.x release is 20.20.2 (2026-03-24). 26.11.1 is current and not LTS yet. | `nodejs/node` published security-advisory list was empty |

New apps: Node **24** LTS, minimum **22**. Laravel **13.36** (floor **13.30.0**);
existing Laravel 12 stays on **≥ 12.69.0**. Expo seed follows SDK **57**
(`react-native` 0.86.3). That native pin does not include `react-server-dom-*`.

## Cite

`CVE-YYYY-#####` + package + installed version + one-line floor.
Any **hit** = VETO (same as audit HIGH+).