Dependencies and vulnerabilities (CVE)

In short: Modern software consists largely of third-party libraries. If a security hole becomes known in one of them (with a CVE number), all programs using it are affected.

In more detail: CVE (Common Vulnerabilities and Exposures) is a worldwide catalogue of known vulnerabilities with an identifier such as CVE-2021-44228 (Log4Shell). The CVSS score (0 to 10) rates severity.

In Depth

• Checking: npm audit, Dependabot, Renovate and scanners show vulnerable packages.
• Updating: regularly and with tests. Apply security patches quickly.
• Lockfile: keeps the checked versions fixed.
• Fewer dependencies: Every additional library is another risk.
• Supply chain attack: Attackers sneak malicious code into popular packages (typosquatting, hijacked accounts).
• SBOM: a bill of materials of all components of software. The Cyber Resilience Act demands something like it for products.

See also: OWASP Top 10, Semantic versioning