No known critical CVEs in production dependencies

OWASP A06 (Vulnerable and Outdated Components) is the category behind some of the most damaging breaches in recent memory. A single critical CVE in a production dependency — like prototype pollution in lodash or remote code execution in a widely-used serializer — gives an attacker a direct entry point into your running application. The CISA KEV catalog tracks CVEs with confirmed exploits in the wild; if any of your dependencies appear there, your production environment is actively targeted. SSDF PW.4 requires that software be tested for weaknesses, and shipping with known critical vulnerabilities is a categorical failure of that control. CWE-1357 (Reliance on Insufficiently Trustworthy Component) names the exact defect class. A critical CVE is not a theoretical risk — it is a scored, published attack path with a working exploit.

Run npm audit fix immediately. For vulnerabilities that cannot be auto-resolved, pin the fixed version or use overrides in package.json as a bridge:

"overrides": {
  "vulnerable-transitive-dep": "^2.0.0"
}

After patching, verify no critical issues remain with npm audit --omit=dev --audit-level=critical. Add this command to your CI pipeline so critical CVEs block merges before they reach production.