No known high-severity CVEs in production dependencies

High-severity CVEs documented under OWASP A06 and CWE-1357 may not have immediate public exploits, but they represent scored weaknesses in production code that attackers actively scan for. A high-severity SSRF vulnerability in axios (CVE-2021-3749) or a ReDoS in a string-processing library can be chained with other weaknesses to achieve full compromise. SSDF PW.4 requires software weaknesses be identified and addressed; carrying known high-severity CVEs means that control is failing. Unlike critical CVEs, high-severity issues may not immediately block your CI, but they accumulate into a risk debt that eventually gets called in — often at the worst possible moment. The fix window should be measured in days, not sprints.

Resolve high-severity CVEs this sprint. Run the audit scoped to production dependencies only:

npm audit --omit=dev --audit-level=high
npm audit fix

For transitive vulnerabilities that can't be auto-fixed, use overrides in package.json to force the patched version. Verify resolution by re-running npm audit --omit=dev --audit-level=high and confirming zero findings.