{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "adm-zip": {
      "name": "adm-zip",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1193734,
          "name": "adm-zip",
          "dependency": "adm-zip",
          "title": "adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite",
          "url": "https://github.com/advisories/GHSA-vwc7-r8mq-g2x9",
          "severity": "moderate",
          "cwe": [
            "CWE-59"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"
          },
          "range": ">=0.5.9 <=0.6.0"
        },
        {
          "source": 1239030,
          "name": "adm-zip",
          "dependency": "adm-zip",
          "title": "adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)",
          "url": "https://github.com/advisories/GHSA-7q85-xj36-vmfc",
          "severity": "high",
          "cwe": [
            "CWE-789"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<0.6.1"
        },
        {
          "source": 1240032,
          "name": "adm-zip",
          "dependency": "adm-zip",
          "title": "adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0",
          "url": "https://github.com/advisories/GHSA-rcw4-f5rp-g42v",
          "severity": "high",
          "cwe": [
            "CWE-409"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=0.6.0"
        },
        {
          "source": 1240034,
          "name": "adm-zip",
          "dependency": "adm-zip",
          "title": "adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation",
          "url": "https://github.com/advisories/GHSA-j5f4-cc29-5x44",
          "severity": "high",
          "cwe": [
            "CWE-732"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
          },
          "range": "<=0.6.0"
        },
        {
          "source": 1240064,
          "name": "adm-zip",
          "dependency": "adm-zip",
          "title": "adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content",
          "url": "https://github.com/advisories/GHSA-p634-w6r4-rjp2",
          "severity": "moderate",
          "cwe": [
            "CWE-436",
            "CWE-696"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<=0.6.0"
        },
        {
          "source": 1240065,
          "name": "adm-zip",
          "dependency": "adm-zip",
          "title": "adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path",
          "url": "https://github.com/advisories/GHSA-c6fg-446q-cg94",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<=0.6.0"
        },
        {
          "source": 1240066,
          "name": "adm-zip",
          "dependency": "adm-zip",
          "title": "adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)",
          "url": "https://github.com/advisories/GHSA-8238-w5pm-2374",
          "severity": "high",
          "cwe": [
            "CWE-248",
            "CWE-400"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=0.6.0"
        }
      ],
      "effects": [],
      "range": "<=0.6.0",
      "nodes": [
        "node_modules/adm-zip"
      ],
      "fixAvailable": true
    },
    "brace-expansion": {
      "name": "brace-expansion",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1240103,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
          "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=4.0.0 <5.0.12"
        },
        {
          "source": 1240107,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
          "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <5.0.11"
        },
        {
          "source": 1240111,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
          "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <5.0.10"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 5.0.11",
      "nodes": [
        "node_modules/brace-expansion"
      ],
      "fixAvailable": true
    },
    "fast-uri": {
      "name": "fast-uri",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1240091,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets",
          "url": "https://github.com/advisories/GHSA-hrr3-gc8f-f4qj",
          "severity": "moderate",
          "cwe": [
            "CWE-178"
          ],
          "cvss": {
            "score": 4.8,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": ">=3.0.0 <3.1.8"
        }
      ],
      "effects": [],
      "range": "3.0.0 - 3.1.7",
      "nodes": [
        "node_modules/fast-uri"
      ],
      "fixAvailable": true
    },
    "hono": {
      "name": "hono",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1240640,
          "name": "hono",
          "dependency": "hono",
          "title": "hono/jsx renders plain strings unescaped in boundary components, leading to XSS",
          "url": "https://github.com/advisories/GHSA-hxh3-vqpv-xpqv",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 4.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<4.13.7"
        }
      ],
      "effects": [],
      "range": "<4.13.7",
      "nodes": [
        "node_modules/hono"
      ],
      "fixAvailable": true
    },
    "ip-address": {
      "name": "ip-address",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1239948,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts",
          "url": "https://github.com/advisories/GHSA-rpw4-54j3-4h4q",
          "severity": "moderate",
          "cwe": [
            "CWE-697",
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.5.0"
        },
        {
          "source": 1239949,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass",
          "url": "https://github.com/advisories/GHSA-2vr4-cq9g-pvrc",
          "severity": "moderate",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=10.2.0 <=10.5.0"
        },
        {
          "source": 1240097,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range",
          "url": "https://github.com/advisories/GHSA-j6r3-76f7-8jcv",
          "severity": "moderate",
          "cwe": [
            "CWE-697",
            "CWE-843"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.7.0"
        },
        {
          "source": 1240098,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process",
          "url": "https://github.com/advisories/GHSA-h3mg-xc3c-68pw",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.7.0"
        }
      ],
      "effects": [],
      "range": "<=10.7.0",
      "nodes": [
        "node_modules/ip-address"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 3,
      "high": 2,
      "critical": 0,
      "total": 5
    },
    "dependencies": {
      "prod": 171,
      "dev": 501,
      "optional": 84,
      "peer": 1,
      "peerOptional": 0,
      "total": 680
    }
  }
}