Stop 25 of 42 · The Vault · Vulnerable dependencies (CVEs)

The lock the vendor warned about

Your bank did not make its own locks. It bought them from a vendor, like most banks. Then researchers announce that one lock model can be picked in seconds, and the vendor ships a fixed model. If nobody replaces the old lock, the public warning becomes Mallory’s instruction sheet.

Severity Low–Critical (Medium when unknown)Category Dependency VulnerabilityThe VaultSources checked 25 Oct 2026

Watch it happen

Play it as

A lock model is announced as pickable and a fix is released. The bank never replaces its lock, and Mallory picks it.

Arrival

The bank buys its locks from a vendor, like most banks. The truck delivers Vendor lock v2.1 for the vault. Your app does the same with packages from npm, pip or Maven.

Lock vendor to Lock v2.1: delivered.
1 / 5

In bank terms and app terms

In the bankIn your app
Lock vendorThe packages you install (npm, pip, Maven)
Lock model and versionA dependency name and its exact version
Public pickable-lock warningA published advisory (CVE / GHSA) listed in vulnerability databases
Replacing the lockUpgrading to the patched version and redeploying

Are you exposed?

You might be exposed if…
  • Your package.json, requirements.txt or pom.xml has old pinned versions that you have not touched in months.
  • npm audit, pip-audit or GitHub’s Dependabot tab shows high or critical alerts you have not looked at.
  • You rarely redeploy, or you copy install commands from AI tools without checking the versions they pick.
What to do about it
  1. Turn on Dependabot or Renovate and review its update PRs weekly.
  2. Run npm audit (or pip-audit / the OWASP dependency-check Maven plugin) in CI and fail builds on high or critical findings.
  3. Commit your lockfile, remove unused packages, and prefer well-maintained libraries. Flaws often hide in transitive dependencies, which npm audit and Dependabot also cover.

Track these in your to-do list →

It has happened to real companies

Real-world breaches

Equifax (2017) — 147 million people's records were stolen through an unpatched Apache Struts dependency (CVE-2017-5638). Equifax was alerted to the flaw in March 2017 and did not patch it. In 2019 Equifax agreed to pay at least $575 million, and up to $700 million, to settle with US regulators and states.

Log4Shell / Log4j (2021) — CVE-2021-44228 in Apache Log4j let an attacker who controlled log messages make the application load and run code from a server the attacker chose. It scored the maximum severity (CVSS 10.0), and CISA described Log4j as "very broadly used in a variety of consumer and enterprise services, websites, and applications."

What it looks like in code

{
  "dependencies": {
    "next": "13.0.0",           // Multiple critical CVEs
    "jsonwebtoken": "8.5.1",    // CVE: algorithm confusion attack
    "lodash": "4.17.15",        // CVE-2019-10744: prototype pollution
    "axios": "0.21.0"           // CVE-2021-3749: ReDoS
  }
}

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt
Audit my project dependencies for known vulnerabilities. Run npm audit (or the pip/Maven equivalent), upgrade each vulnerable package to the nearest patched version, run the tests and build, and tell me about any breaking changes. Then add a Dependabot config and a CI step that fails on high or critical vulnerabilities, and remove packages I do not use.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.