epicweb-dev/epic-stack dependency check
epicweb-dev/epic-stack: 6 critical findings, each with a fixed version. Plus 17 warnings.
Last checked against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, npm and endoflife.date.
23 things your coding agent doesn’t know about this repo
epicweb-dev/epic-stack on GitHub (opens in a new tab)
6 critical17 warnings32 low priority
One task with every fix, most urgent first, the file to change and why. Paste it into Claude Code, Cursor or Codex.
- CriticalVulnerabilitypackage.json
5 known vulnerabilities in react-router 7.16.0
EPSS: top 48%2 rated high or critical. Most serious: CVE-2026-55685, React Router: Unauthenticated Denial of Service via Inefficient Route Matching. Upgrading to 7.18.2 fixes all of them.
- CriticalVulnerabilitypackage.json
CVE-2026-87776 in compression 1.8.1
EPSS: top 53%compression vulnerable to Denial of Service via memory leak on premature response close. Fixed in 1.8.2.
- CriticalVulnerabilitypackage.json
CVE-2026-30827 in express-rate-limit 8.2.1
EPSS: top 57%express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network. Fixed in 8.2.2.
- CriticalVulnerabilitypackage.json
2 known vulnerabilities in @remix-run/server-runtime 2.17.4
EPSS: top 62%1 rated high or critical. Most serious: CVE-2026-42342, React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint. Upgrading to 2.17.5 fixes all of them.
- CriticalVulnerabilitypackage.json
3 known vulnerabilities in sharp 0.34.5
3 rated high or critical. Most serious: GHSA-f88m-g3jw-g9cj, sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591. Upgrading to 0.35.5 fixes all of them.
- CriticalEnd of lifepackage.json
Tailwind CSS 4.1 is end-of-life
Support ended 2026-02-18. No more security fixes — upgrade to Tailwind CSS 4.3 (4.3.3).
- WarningVulnerabilitypackage.json
5 known vulnerabilities in vite 7.3.1
EPSS: top 15%Dev onlyMost serious: CVE-2026-39363, Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket. Upgrading to 7.3.5 fixes all of them.
- WarningVulnerabilitypackage.json
2 known vulnerabilities in vitest 4.0.18
EPSS: top 42%Dev onlyMost serious: CVE-2026-47429, When Vitest UI server is listening, arbitrary file can be read and executed. Upgrading to 4.1.11 fixes all of them.
- WarningVulnerabilitypackage-lock.json
CVE-2026-49250 in @conform-to/dom 1.16.0
EPSS: top 58%Indirect@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields. Fixed in 1.19.4.
- WarningVulnerabilitypackage-lock.json
CVE-2026-25547 in @isaacs/brace-expansion 5.0.0
EPSS: top 59%Indirect@isaacs/brace-expansion has Uncontrolled Resource Consumption. Fixed in 5.0.1.
- WarningVulnerabilitypackage.json
3 known vulnerabilities in morgan 1.10.1
EPSS: top 66%Most serious: CVE-2026-5078, morgan vulnerable to Log Forging via unneutralized control characters in :remote-user. Upgrading to 1.12.1 fixes all of them.
- WarningVulnerabilitypackage-lock.json
CVE-2026-54285 in @opentelemetry/core 2.5.0
EPSS: top 68%IndirectOpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation. Fixed in 2.8.0.
- WarningVulnerabilitypackage-lock.json
CVE-2026-40181 in @remix-run/router 1.23.2
EPSS: top 82%IndirectReact Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation. Fixed in 1.23.3.
- WarningVulnerabilitypackage-lock.json
CVE-2026-104872 in @opentelemetry/instrumentation-knex 0.55.0
EPSS: top 86%IndirectMultiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute. Fixed in 0.65.0.
- WarningVulnerabilitypackage-lock.json
CVE-2026-104872 in @opentelemetry/instrumentation-mongoose 0.57.0
EPSS: top 86%IndirectMultiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute. Fixed in 0.67.0.
- WarningVulnerabilitypackage-lock.json
CVE-2026-104872 in @opentelemetry/instrumentation-mysql 0.57.0
EPSS: top 86%IndirectMultiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute. Fixed in 0.67.0.
- WarningVulnerabilitypackage-lock.json
CVE-2026-104872 in @opentelemetry/instrumentation-mysql2 0.57.0
EPSS: top 86%IndirectMultiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute. Fixed in 0.67.0.
- WarningVulnerabilitypackage-lock.json
CVE-2026-104872 in @opentelemetry/instrumentation-pg 0.63.0
EPSS: top 86%IndirectMultiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute. Fixed in 0.73.0.
- WarningVulnerabilitypackage-lock.json
CVE-2026-104872 in @opentelemetry/instrumentation-tedious 0.30.0
EPSS: top 86%IndirectMultiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute. Fixed in 0.40.0.
- WarningVulnerabilitypackage.json
CVE-2026-73231 in @faker-js/faker 10.2.0
EPSS: top 90%Dev onlyFaker: helpers.fake exploitable into arbritary code execution. Fixed in 10.5.0.
- WarningMaintenancepackage.json
@oslojs/crypto is deprecated on npm
The maintainers' deprecation notice: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
- WarningMaintenancepackage.json
@react-email/components is deprecated on npm
The maintainers' deprecation notice: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
- WarningOutdatedpackage.json
prisma 6.19.2 is 2 major versions behind
Latest release is 8.0.0-rc.23.
Checked 400 packages from package.json and package-lock.json against:
Add this badge to your README
It shows today’s result and links to this report, so anyone opening the repo sees what needs fixing.
[](https://stackprism.ai/check/github/epicweb-dev/epic-stack)What next
Want your agent to check before it adds a package? Connect Claude Code, Cursor or Codex to StackPrism. Setup steps
Ask Prism Agent about epicweb-dev/epic-stack
Map the repo (free) and ask what to fix first, whether an upgrade is safe, or what breaks if a service goes down. Prism Agent checks live sources before it answers.
How this report works
StackPrism read package.json and package-lock.json from the default branch of epicweb-dev/epic-stack and checked its 400 packages against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, npm and endoflife.date. Nothing was installed or run, and there’s no AI in the findings: each one comes from a source you can open.
Vulnerabilities come from OSV.dev, with known-exploited ones from CISA marked and listed first. Runtimes, frameworks and base images are checked against endoflife.date, and packages against their registry for deprecations and major versions you’ve fallen behind. The fix task above lists every change with the file to edit.
This page refreshes every few hours; after you push a fix, “Check again” runs it now. Only the repo’s root is read. For an app in a sub-folder, paste the folder’s link into the dependency check, and for a private repo, connect GitHub.