Repository navigation
🔒 [IBM OSPO Security Notification] — IBM/nodejs-itoolkit #437
Description
🔒 [IBM OSPO Security Notification] — IBM/nodejs-itoolkit
Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.SLA policy: critical = 7 days, high = 30 days, medium = 90 days.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved.💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.
Attention: @kadler @ThePrez @abmusse
Dependabot Alerts
| Severity | CVE/GHSA | Package | Affected | Patched | Deadline | Fix PR |
|---|---|---|---|---|---|---|
| 🔴 critical | GHSA-6q48-6c7w-9gw2 | certifi | >= 2019.03.09, < 2026.10.18 | 2026.10.18 | 2026-11-17 | PR |
| 🟠 high | CVE-2026-84961 | undici | >= 7.24.1, < 7.29.1 | 7.29.1 | 2026-12-10 | PR |
| 🟠 high | CVE-2026-97687 | urllib3 | >= 1.26.0, < 2.8.0 | 2.8.0 | 2026-12-10 | PR |
| 🟠 high | CVE-2026-97689 | urllib3 | >= 1.10.3, < 2.8.0 | 2.8.0 | 2026-12-10 | PR |
| 🟠 high | CVE-2026-109869 | undici | >= 7.18.0, < 7.30.1 | 7.30.1 | 2026-12-10 | PR |
| 🟠 high | CVE-2026-109829 | undici | >= 7.0.0, < 7.30.1 | 7.30.1 | 2026-12-10 | PR |
| 🟠 high | CVE-2026-87018 | undici | >= 7.0.0, < 7.30.1 | 7.30.1 | 2026-12-10 | PR |
| 🟠 high | CVE-2026-109383 | undici | >= 7.0.0, < 7.30.1 | 7.30.1 | 2026-12-10 | PR |
| 🟡 medium | CVE-2026-84933 | undici | >= 7.0.0, < 7.29.1 | 7.29.1 | 2027-02-08 | PR |
| 🟡 medium | CVE-2026-18149 | undici | >= 7.11.0, < 7.29.1 | 7.29.1 | 2027-02-08 | PR |
| 🟡 medium | CVE-2026-102277 | brace-expansion | < 1.1.21 | 1.1.21 | 2027-02-08 | PR |
| 🟡 medium | CVE-2026-97688 | urllib3 | >= 2.6.2, < 2.8.0 | 2.8.0 | 2027-02-08 | — |
| 🟡 medium | CVE-2026-109932 | undici | >= 7.0.0, < 7.30.1 | 7.30.1 | 2027-02-08 | PR |
| 🟡 medium | CVE-2026-126345 | basic-ftp | <= 6.2.3 | 6.2.4 | 2027-02-11 | — |
Code Scanning Alerts
| Severity | Rule | Tool | Deadline |
|---|---|---|---|
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
| 🟡 medium | js/polynomial-redos | CodeQL | 2027-01-12 |
Secret Scanning Alerts
No open secret scanning alerts.
Activity
security-ops-bot commentedon Oct 14, 2026
🔄 Code & Secret Scanning Alert Changes
Added:
cs-21(code-scanning, medium),cs-20(code-scanning, medium),cs-19(code-scanning, medium),cs-18(code-scanning, medium),cs-17(code-scanning, medium),cs-16(code-scanning, medium),cs-15(code-scanning, medium),cs-14(code-scanning, medium),cs-13(code-scanning, medium),cs-12(code-scanning, medium),cs-11(code-scanning, medium),cs-10(code-scanning, medium),cs-9(code-scanning, medium),cs-8(code-scanning, medium),cs-7(code-scanning, medium),cs-6(code-scanning, medium),cs-5(code-scanning, medium),cs-4(code-scanning, medium),cs-3(code-scanning, medium),cs-2(code-scanning, medium),cs-1(code-scanning, medium)security-ops-bot commentedon Oct 19, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-102277(medium)security-ops-bot commentedon Oct 26, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-97687(high),CVE-2026-97689(high),CVE-2026-97688(medium),GHSA-6q48-6c7w-9gw2(critical),CVE-2026-109869(high)security-ops-bot commentedon Oct 27, 2026
🔄 Dependabot Alert Changes
Resolved:
GHSA-6q48-6c7w-9gw2security-ops-bot commentedon Nov 5, 2026
🔄 Dependabot Alert Changes
Added:
GHSA-6q48-6c7w-9gw2(critical),CVE-2026-109829(high),CVE-2026-87018(high),CVE-2026-109932(medium),CVE-2026-109383(high)security-ops-bot commentedon Nov 9, 2026
🔄 Dependabot Alert Changes
Resolved:
CVE-2026-84961,CVE-2026-84933,CVE-2026-18149,CVE-2026-102277,CVE-2026-97687,CVE-2026-97689,CVE-2026-97688,CVE-2026-109869,GHSA-6q48-6c7w-9gw2,CVE-2026-109829,CVE-2026-87018,CVE-2026-109932,CVE-2026-109383security-ops-bot commentedon Nov 10, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-84961(high),CVE-2026-84933(medium),CVE-2026-18149(medium),CVE-2026-102277(medium),CVE-2026-97687(high),CVE-2026-97689(high),CVE-2026-97688(medium),CVE-2026-109869(high),GHSA-6q48-6c7w-9gw2(critical),CVE-2026-109829(high),CVE-2026-87018(high),CVE-2026-109932(medium),CVE-2026-109383(high)security-ops-bot commentedon Nov 13, 2026
🔄 Dependabot Alert Changes
Added:
CVE-2026-126345(medium)