🔒 [IBM OSPO Security Notification] — IBM/react-native-authentication-mobileApp

[security-ops-bot]

🔒 [IBM OSPO Security Notification] — IBM/react-native-authentication-mobileApp

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.

Attention: @hgidwani

Dependabot Alerts

Severity	CVE/GHSA	Package	Affected	Patched	Deadline	Fix PR
🔴 critical	CVE-2025-23061	mongoose	< 6.13.6	6.13.6	2026-10-07	—
🔴 critical	CVE-2026-25896	fast-xml-parser	>= 4.1.3, < 4.5.4	4.5.4	2026-10-07	—
🟠 high	CVE-2024-43398	rexml	< 3.3.6	3.3.6	2026-10-30	—
🟠 high	CVE-2024-45590	body-parser	< 1.20.3	1.20.3	2026-10-30	—
🟠 high	CVE-2024-53900	mongoose	>= 6.0.0-rc0, < 6.13.5	6.13.5	2026-10-30	—
🟠 high	CVE-2026-26278	fast-xml-parser	>= 4.1.3, < 4.5.4	4.5.4	2026-10-30	—
🟠 high	CVE-2026-33036	fast-xml-parser	>= 4.0.0-beta.3, < 4.5.5	4.5.5	2026-10-30	—
🟠 high	CVE-2026-4867	path-to-regexp	< 0.1.13	0.1.13	2026-10-30	—
🟠 high	CVE-2026-35611	addressable	>= 2.3.0, < 2.9.0	2.9.0	2026-10-30	—
🟠 high	CVE-2026-42334	mongoose	< 6.13.9	6.13.9	2026-10-30	—
🟠 high	CVE-2026-54904	concurrent-ruby	< 1.3.7	1.3.7	2026-10-30	—
🟠 high	CVE-2026-69192	ip-address	<= 10.3.0	10.3.1	2026-10-30	PR
🟡 medium	CVE-2024-29041	express	< 4.19.2	4.19.2	2026-12-29	—
🟡 medium	CVE-2024-35176	rexml	< 3.2.7	3.2.7	2026-12-29	—
🟡 medium	CVE-2024-39908	rexml	< 3.3.2	3.3.2	2026-12-29	—
🟡 medium	CVE-2024-41123	rexml	< 3.3.3	3.3.3	2026-12-29	—
🟡 medium	CVE-2024-41946	rexml	< 3.3.3	3.3.3	2026-12-29	—
🟡 medium	CVE-2024-49761	rexml	< 3.3.9	3.3.9	2026-12-29	—
🟡 medium	CVE-2025-15284	qs	< 6.14.1	6.14.1	2026-12-29	—
🟡 medium	CVE-2026-33170	activesupport	< 7.2.3.1	7.2.3.1	2026-12-29	—
🟡 medium	CVE-2026-33169	activesupport	< 7.2.3.1	7.2.3.1	2026-12-29	—
🟡 medium	CVE-2026-33176	activesupport	< 7.2.3.1	7.2.3.1	2026-12-29	—
🟡 medium	CVE-2026-33349	fast-xml-parser	>= 4.0.0-beta.3, < 4.5.5	4.5.5	2026-12-29	—
🟡 medium	CVE-2026-41650	fast-xml-parser	< 5.7.0	5.7.0	2026-12-29	—
🟡 medium	CVE-2026-42338	ip-address	<= 10.1.0	10.1.1	2026-12-29	PR
🟡 medium	CVE-2026-41907	uuid	< 11.1.1	11.1.1	2026-12-29	—
🟡 medium	CVE-2026-73562	mongoose	< 6.13.10	6.13.10	2026-12-29	—
🟡 medium	CVE-2026-82417	qs	>= 2.2.5, < 6.16.0	6.16.0	2026-12-29	—
🟡 medium	CVE-2026-101913	ip-address	<= 10.5.0	10.5.1	2026-12-28	PR
🔵 low	CVE-2024-43796	express	< 4.20.0	4.20.0	—	—
🔵 low	CVE-2024-43800	serve-static	< 1.16.0	1.16.0	—	—
🔵 low	CVE-2024-43799	send	< 0.19.0	0.19.0	—	—
🔵 low	CVE-2024-47764	cookie	< 0.7.0	0.7.0	—	—
🔵 low	GHSA-6475-r3vj-m8vf	@smithy/config-resolver	< 4.4.0	4.4.0	—	—
🔵 low	CVE-2026-2391	qs	>= 6.7.0, <= 6.14.1	6.14.2	—	—
🔵 low	CVE-2026-27942	fast-xml-parser	>= 4.0.0-beta.0, < 4.5.4	4.5.4	—	—
🔵 low	CVE-2026-54906	concurrent-ruby	< 1.3.7	1.3.7	—	—
🔵 low	CVE-2026-54905	concurrent-ruby	< 1.3.7	1.3.7	—	—
🔵 low	CVE-2026-12590	body-parser	< 1.20.6	1.20.6	—	—

Code Scanning Alerts

Severity	Rule	Tool	Deadline
🟠 high	js/sql-injection	CodeQL	2026-10-29
🟠 high	js/sql-injection	CodeQL	2026-10-29
🟠 high	js/sql-injection	CodeQL	2026-10-29
🟠 high	js/sql-injection	CodeQL	2026-10-29
🟠 high	js/sql-injection	CodeQL	2026-10-29
🟠 high	js/redos	CodeQL	2026-10-29
🟠 high	js/redos	CodeQL	2026-10-29
🟡 medium	js/missing-rate-limiting	CodeQL	2026-12-28
🟡 medium	js/missing-rate-limiting	CodeQL	2026-12-28
🟡 medium	js/missing-rate-limiting	CodeQL	2026-12-28
🟡 medium	js/missing-rate-limiting	CodeQL	2026-12-28
🟡 medium	js/missing-rate-limiting	CodeQL	2026-12-28
🟡 medium	js/missing-rate-limiting	CodeQL	2026-12-28
🟡 medium	js/missing-rate-limiting	CodeQL	2026-12-28
🟡 medium	js/cors-permissive-configuration	CodeQL	2026-12-28

Secret Scanning Alerts

No open secret scanning alerts.

---

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: CVE-2026-42338, CVE-2026-42334, CVE-2026-41907, CVE-2026-54906, CVE-2026-54904, CVE-2026-54905, CVE-2026-12590, CVE-2026-73562, CVE-2026-69192

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2024-29041 (medium), CVE-2024-35176 (medium), CVE-2024-39908 (medium), CVE-2024-41123 (medium), CVE-2024-41946 (medium), CVE-2024-43398 (high), CVE-2024-45590 (high), CVE-2024-43796 (low), CVE-2024-43800 (low), CVE-2024-43799 (low), CVE-2024-47764 (low), CVE-2024-49761 (medium), CVE-2025-23061 (critical), CVE-2025-15284 (medium), GHSA-6475-r3vj-m8vf (low), CVE-2024-53900 (high), CVE-2026-2391 (low), CVE-2026-26278 (high), CVE-2026-25896 (critical), CVE-2026-27942 (low), CVE-2026-33170 (medium), CVE-2026-33169 (medium), CVE-2026-33176 (medium), CVE-2026-33036 (high), CVE-2026-4867 (high), CVE-2026-35611 (high), CVE-2026-33349 (medium), CVE-2026-41650 (medium), CVE-2026-42338 (medium), CVE-2026-42334 (high), CVE-2026-41907 (medium), CVE-2026-54906 (low), CVE-2026-54904 (high), CVE-2026-54905 (low), CVE-2026-12590 (low), CVE-2026-73562 (medium), CVE-2026-69192 (high)

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: CVE-2024-29041, CVE-2024-35176, CVE-2024-39908, CVE-2024-41123, CVE-2024-41946, CVE-2024-43398, CVE-2024-45590, CVE-2024-43796, CVE-2024-43800, CVE-2024-43799, CVE-2024-47764, CVE-2024-49761, CVE-2025-23061, CVE-2025-15284, GHSA-6475-r3vj-m8vf, CVE-2024-53900, CVE-2026-2391, CVE-2026-26278, CVE-2026-25896, CVE-2026-27942, CVE-2026-33170, CVE-2026-33169, CVE-2026-33176, CVE-2026-33036, CVE-2026-4867, CVE-2026-35611, CVE-2026-33349, CVE-2026-41650, CVE-2026-42338, CVE-2026-42334, CVE-2026-41907, CVE-2026-54906, CVE-2026-54904, CVE-2026-54905, CVE-2026-12590, CVE-2026-73562, CVE-2026-69192

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-54906 (low), CVE-2026-54904 (high), CVE-2026-54905 (low), CVE-2026-12590 (low), CVE-2026-73562 (medium), CVE-2026-69192 (high)

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-26278 (high), CVE-2026-25896 (critical), CVE-2026-27942 (low), CVE-2026-33170 (medium), CVE-2026-33169 (medium), CVE-2026-33176 (medium), CVE-2026-33036 (high), CVE-2026-4867 (high), CVE-2026-35611 (high), CVE-2026-33349 (medium), CVE-2026-41650 (medium), CVE-2026-42338 (medium), CVE-2026-42334 (high), CVE-2026-41907 (medium)

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: CVE-2026-26278, CVE-2026-25896, CVE-2026-27942, CVE-2026-33170, CVE-2026-33169, CVE-2026-33176, CVE-2026-33036, CVE-2026-4867, CVE-2026-35611, CVE-2026-33349, CVE-2026-41650

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-101913 (medium)

Resolved: CVE-2026-42338, CVE-2026-42334, CVE-2026-41907, CVE-2026-54906, CVE-2026-54904, CVE-2026-54905, CVE-2026-12590, CVE-2026-73562, CVE-2026-69192, CVE-2026-82417

[security-ops-bot]

🔄 Code & Secret Scanning Alert Changes

Added: cs-15 (code-scanning, high), cs-14 (code-scanning, high), cs-13 (code-scanning, high), cs-12 (code-scanning, high), cs-11 (code-scanning, high), cs-10 (code-scanning, medium), cs-9 (code-scanning, medium), cs-8 (code-scanning, medium), cs-7 (code-scanning, medium), cs-6 (code-scanning, medium), cs-5 (code-scanning, medium), cs-4 (code-scanning, medium), cs-3 (code-scanning, medium), cs-2 (code-scanning, high), cs-1 (code-scanning, high)

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2024-29041 (medium), CVE-2024-35176 (medium), CVE-2024-39908 (medium), CVE-2024-41123 (medium), CVE-2024-41946 (medium), CVE-2024-43398 (high), CVE-2024-45590 (high), CVE-2024-43796 (low), CVE-2024-43800 (low), CVE-2024-43799 (low), CVE-2024-47764 (low), CVE-2024-49761 (medium), CVE-2025-23061 (critical), CVE-2025-15284 (medium), GHSA-6475-r3vj-m8vf (low), CVE-2024-53900 (high), CVE-2026-2391 (low), CVE-2026-26278 (high), CVE-2026-25896 (critical), CVE-2026-27942 (low), CVE-2026-33170 (medium), CVE-2026-33169 (medium), CVE-2026-33176 (medium), CVE-2026-33036 (high), CVE-2026-4867 (high), CVE-2026-35611 (high), CVE-2026-33349 (medium), CVE-2026-41650 (medium), CVE-2026-42338 (medium), CVE-2026-42334 (high), CVE-2026-41907 (medium), CVE-2026-54906 (low), CVE-2026-54904 (high), CVE-2026-54905 (low), CVE-2026-12590 (low), CVE-2026-73562 (medium), CVE-2026-69192 (high), CVE-2026-82417 (medium)