CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
From 11 September 2026, an actively exploited vulnerability in software you ship must be reported to ENISA within 24 hours of awareness (CRA Art. 14). In this snapshot, 2 findings are in the CISA KEV catalog (0 in production dependencies):
| Package | Your version | CVE | Fixed in | Exploit context |
|---|---|---|---|---|
| vite dev | ^7.1.1 (unpinned) | CVE-2025-31125 | 6.2.4 | KEV listed 2026-01-22 |
| eslint-config-prettier dev | ^10.1.8 (unpinned) | CVE-2025-54313 | 8.10.2 | KEV listed 2026-01-22 |
⚠ No lockfile — SBOM is not reproducible
This scan is based on a manifest (composer.lock, package.json), not a lockfile. 37 of 279 dependencies are version ranges, so the exact shipped versions — and their transitive dependencies — cannot be verified. Under the CRA's full obligations (11 December 2027) you must produce a machine-readable SBOM of what you actually ship. Committing a lockfile is the single highest-impact fix in this report.
All findings (132)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| vite dev | ^7.1.1 | CVE-2025-30208 | MODERATE | 75.0% | 6.2.3 | Vite bypasses server.fs.deny when using ?raw?? |
| vite dev | ^7.1.1 | CVE-2025-31486 | MODERATE | 40.5% | 6.2.5 | Vite allows server.fs.deny to be bypassed with .svg or relative paths |
| lodash dev | ^4.17.21 | CVE-2021-23337 | HIGH | 21.3% | 4.17.21 | Command Injection in lodash |
| lodash dev | ^4.17.21 | CVE-2021-23337 | HIGH | 21.3% | 4.18.0 | lodash vulnerable to Code Injection via `_.template` imports key names |
| axios dev | ^1.11.0 | CVE-2021-3749 | HIGH | 8.5% | 0.21.2 | axios Inefficient Regular Expression Complexity vulnerability |
| lodash dev | ^4.17.21 | CVE-2020-28500 | MODERATE | 7.3% | 4.17.21 | Regular Expression Denial of Service (ReDoS) in lodash |
| axios dev | ^1.11.0 | CVE-2019-10742 | HIGH | 6.0% | 0.18.1 | Denial of Service in axios |
| lodash dev | ^4.17.21 | CVE-2020-8203 | HIGH | 5.2% | 4.17.19 | Prototype Pollution in lodash |
| lodash dev | ^4.17.21 | CVE-2019-10744 | CRITICAL | 5.0% | 4.17.12 | Prototype Pollution in lodash |
| vite dev | ^7.1.1 | CVE-2026-39363 | HIGH | 3.4% | 8.0.5 | Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket |
| lodash dev | ^4.17.21 | CVE-2019-1010266 | MODERATE | 3.2% | 4.17.11 | Regular Expression Denial of Service (ReDoS) in lodash |
| vite dev | ^7.1.1 | CVE-2023-34092 | HIGH | 3.1% | 2.9.16 | Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) |
| axios dev | ^1.11.0 | CVE-2026-25639 | HIGH | 2.7% | 1.13.5 | Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig |
| lodash dev | ^4.17.21 | CVE-2018-3721 | MODERATE | 2.4% | 4.17.5 | Prototype Pollution in lodash |
| axios dev | ^1.11.0 | CVE-2020-28168 | MODERATE | 2.4% | 0.21.1 | Axios vulnerable to Server-Side Request Forgery |
| vite dev | ^7.1.1 | CVE-2026-39364 | HIGH | 2.0% | 8.0.5 | Vite: `server.fs.deny` bypassed with queries |
| axios dev | ^1.11.0 | CVE-2026-40175 | MODERATE | 1.9% | 1.15.0 | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain |
| vite dev | ^7.1.1 | CVE-2025-32395 | MODERATE | 1.7% | 6.2.6 | Vite has an `server.fs.deny` bypass with an invalid `request-target` |
| lodash dev | ^4.17.21 | CVE-2025-13465 | MODERATE | 1.6% | 4.18.0 | lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` |
| lodash dev | ^4.17.21 | CVE-2025-13465 | MODERATE | 1.6% | 4.17.23 | Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions |
| lodash dev | ^4.17.21 | CVE-2018-16487 | HIGH | 1.6% | 4.17.11 | Prototype Pollution in lodash |
| symfony/http-foundation | 7.3.2 | CVE-2025-64500 | HIGH | 1.3% | 5.4.50 | Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass |
| vite dev | ^7.1.1 | CVE-2022-35204 | HIGH | 1.3% | 2.9.13 | Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service |
| vite dev | ^7.1.1 | CVE-2025-58751 | LOW | 1.2% | 7.1.5 | Vite middleware may serve files starting with the same name with the public directory |
| axios dev | ^1.11.0 | CVE-2024-39338 | HIGH | 1.2% | 1.7.4 | Server-Side Request Forgery in axios |
| axios dev | ^1.11.0 | CVE-2025-62718 | MODERATE | 1.2% | 1.15.0 | Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF |
| vite dev | ^7.1.1 | CVE-2025-46565 | MODERATE | 1.2% | 6.3.4 | Vite's server.fs.deny bypassed with /. for files under project root |
| axios dev | ^1.11.0 | CVE-2025-58754 | HIGH | 1.1% | 1.12.0 | Axios is vulnerable to DoS attack through lack of data size check |
| vite dev | ^7.1.1 | CVE-2024-45811 | MODERATE | 1.1% | 5.4.6 | Vite's `server.fs.deny` is bypassed when using `?import&raw` |
| axios dev | ^1.11.0 | CVE-2026-44494 | HIGH | 1.0% | 1.16.0 | axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
+ 102 further findings (mostly lower severity) — available in the full export.
SBOM summary
279 direct dependencies scanned (242 pinned to exact versions) from composer.lock, package.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.