Outdated dependencies patched within 30 days for high and critical CVEs
Why it matters
Known CVEs in dependencies are the lowest-effort attack path for automated exploitation frameworks like Metasploit. CWE-1104 (Use of Unmaintained Third-Party Components) and OWASP A06 (Vulnerable and Outdated Components) document that most exploited CVEs have patches available — the delay between patch release and application is the attackers' window. NIST 800-53 SI-2 requires timely remediation of vulnerabilities. A high-severity CVE in express, next, or jsonwebtoken can affect every request and is actively targeted by scanners within hours of public disclosure.
Severity rationale
Low because patching is straightforward once a CVE is known, but the risk scales directly with how long unpatched high/critical CVEs remain in production.
Remediation
Check for CVEs immediately and set a 72-hour SLA for high/critical patches:
# Identify vulnerabilities
npm audit
# Auto-fix non-breaking patches
npm audit fix
# Review breaking changes manually before:
# npm audit fix --force
Merge Dependabot security PRs for high and critical severity within 72 hours. For CVEs with no available patch (upstream hasn't released a fix), evaluate whether the vulnerable code path is reachable and document the exception with a target remediation date.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Security Hardening Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-1104 — Use of Unmaintained Third Party Components
- owasp:2021 · A06 — Vulnerable and Outdated Components
- nist:rev5 · SI-2 — Flaw Remediation
Taxons
History
- 2026-04-18·v1.0.0·Initial import from security-hardening·automated