gitsafehub
github.com/graphql-hive/graphql-yoga ↗

graphql-hive/graphql-yoga

scanned 2026-08-03 · git da85d40
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets6Vulnerable dependencies107Known OSS vulnerabilities155Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ 6 found · 1 serious

API keys, passwords or tokens committed into the repo.

  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    packages/plugins/jwt/src/__tests__/jwt.spec.ts:26
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    packages/envelop/plugins/newrelic/README.md:114
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    packages/envelop/plugins/newrelic/README.md:114
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    packages/envelop/plugins/response-cache-cloudflare-kv/test/index.spec.ts:20
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    packages/envelop/plugins/response-cache-cloudflare-kv/test/set.spec.ts:21
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    packages/envelop/plugins/response-cache-cloudflare-kv/test/invalidate.spec.ts:85
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 107 found · 4 serious

Packages you depend on that have known security holes (CVEs).

  • Serious GHSA-7rqj-j65f-68wh Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
    pnpm-lock.yaml
    A package you depend on has a known security hole (GHSA-7rqj-j65f-68wh). Fix: Update that package to its patched version.
  • Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
  • Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
    pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-14257 brace-expansion through 5.0.7 is vulnerable to denial of service via m ...
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49458 dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49459 dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49459). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49978). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65898 DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when ...
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65898). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65902 DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct refe ...
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65902). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59869 js-yaml: js-yaml: Denial of Service via crafted YAML documents
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59869). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53550 js-yaml: js-yaml: Denial of Service via crafted YAML merge keys
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-53550). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-64641 next: Next.js: Denial of Service via crafted requests to App Router with Server Actions
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64641). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-64645 next: Next.js: Server-Side Request Forgery vulnerability
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64645). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-64649 next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64649). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-64643 next: Next.js: Information disclosure via Server Action ID exposure
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64643). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-64644 next: Next.js: Denial of Service via malicious image optimization
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64644). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-64646 next: Next.js: Denial of Service via excessive memory consumption in Server Actions
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64646). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-64647 next: Next.js: Information disclosure via server-side request caching
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64647). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-64648 next: Next.js: Information disclosure via server-side fetch cache
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64648). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45623 postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-45623). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
    envelop-website/package-lock.json
    A package you depend on has a known security hole (GHSA-r28c-9q8g-f849). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41305 postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41305). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45623 postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
    envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-45623). Fix: Update that package to its patched version.
… 82 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 155 found · 5 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-mp2f-45pm-3cg9 Decompress: Archive extraction can create files and links outside of the target directory
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-53486). Fix: Update that package to its patched version.
  • Serious GHSA-7rqj-j65f-68wh Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/pnpm-lock.yaml
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-76mc-f452-cxcm DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65902). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65898). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hpcv-96wg-7vj8 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49458). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r47g-fvhr-h676 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49459). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rp9w-3fw7-7cwq DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49978). Fix: Update that package to its patched version.
  • Worth fixing GHSA-848j-6mx2-7j84 Elliptic Uses a Cryptographic Primitive with a Risky Implementation
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2025-14505). Fix: Update that package to its patched version.
  • Worth fixing GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59869). Fix: Update that package to its patched version.
  • Worth fixing GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-53550). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4633-3j49-mh5q Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64647). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4c39-4ccg-62r3 Next.js: Unbounded Server Action payload in Edge runtime
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64646). Fix: Update that package to its patched version.
  • Worth fixing GHSA-68g3-v927-f742 Next.js: Cache confusion of response bodies for requests with bodies
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64648). Fix: Update that package to its patched version.
  • Worth fixing GHSA-89xv-2m56-2m9x Next.js: Server-Side Request Forgery in Server Actions on custom servers
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64649). Fix: Update that package to its patched version.
  • Worth fixing GHSA-955p-x3mx-jcvp Next.js: Unauthenticated disclosure of internal Server Function endpoints
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64643). Fix: Update that package to its patched version.
  • Worth fixing GHSA-m99w-x7hq-7vfj Next.js: Denial of Service in App Router using Server Actions
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64641). Fix: Update that package to its patched version.
  • Worth fixing GHSA-p9j2-gv94-2wf4 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64645). Fix: Update that package to its patched version.
  • Worth fixing GHSA-q8wf-6r8g-63ch Next.js: Denial of Service in the Image Optimization API using SVGs
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-64644). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-45623). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
    /workdirs/scan-f8615dc9-061a-43ac-9849-2f8b5bac9208/envelop-website/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41305). Fix: Update that package to its patched version.
… 130 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.