dependency-vulnerability-audit

Triage npm audit findings by confirming the vulnerable version is in your lockfile, checking whether your code reaches the vulnerable function, and scoring by exposure and exploit maturity rather than CVSS. Most findings turn out to be dev-only or unreachable noise.

A CVE is exploitable when your code calls the vulnerable function with attacker-influenced input on an exposed service. Check the advisory for the specific affected code path, grep for its usage, and consult CISA KEV for active exploitation evidence.

When no fix exists, mitigate by disabling the vulnerable feature or config, adding a WAF rule, isolating the component, or swapping the dependency. If you accept the risk, document it with a signer and an expiry date.

Fix transitive dependency vulnerabilities by bumping the direct parent if it has a fixed release, otherwise force the resolution with overrides or constraints. Always add a comment and a ticket to remove the override later.

Patching package.json does not fix running services because deployed containers were built from the old lockfile. Rebuild images, redeploy, and rescan the deployed artifact to confirm the fix actually landed.