Why Upgrading Dependencies Is Not Always the Right CVE Fix
Summary
The article argues that dependency upgrades may be unavailable, delayed, or breaking, and outlines backporting fixes to versions already in use as an alternative. It cites package supply-chain risks and promotes Aikido Libraries.
Key points
- The article identifies three cases where upgrading may not resolve a vulnerability: no maintained fixed version exists, a patch has not shipped, or the upgrade introduces breaking changes.
- It uses deprecated Node.js package request and an SSRF mitigation-bypass flaw to illustrate how remediation may require migrating away from a package or backporting a fix.
- It says lodash vulnerabilities affected versions through 4.17.23 while no patched release was available at the time described.
- The article cites CVE-2026-48937 in Node.js as an example where the fix came with a major nghttp2 update and removal of HTTP/2 priority signaling support.
- It describes malicious chalk and debug releases following a maintainer-account compromise as a risk of automatic dependency updates.
- Backporting applies a security fix to the version already in use, but the article notes that isolating and validating the change requires expertise and ongoing maintenance.
- The article promotes Aikido Libraries as an option for fixing vulnerabilities in existing open-source dependencies without upgrading.
Article Details
- Topic
- Risks of treating dependency upgrades as the only response to CVEs, including malware introduced through compromised package-maintainer accounts, unavailable fixes, and breaking changes; backporting is presented as an alternative.
MITRE ATT&CK
CVE
Vendors
Products
Aikido LibrariesThere's now an option that does exactly that: fix vulnerabilities in the open source packages your application depends on without upgrading with Aikido Libraries.Axiosversion). So in this instance, “upgrade” actually means ripping request out and moving to something like axios or node-fetch. That’s a rewrite and a migration, and it means that until someone has time for it, the CVEChalkattackers compromised a maintainer account responsible for some of the most downloaded packages on npm. chalk and debug, between them over two billion downloads a week. They published malicious versions through theDebugcompromised a maintainer account responsible for some of the most downloaded packages on npm. chalk and debug, between them over two billion downloads a week. They published malicious versions through the officialLodashtype of upgrade is when the fix doesn’t exist yet even though the package is alive. The popular library lodash spent a stretch of time last year with two disclosed vulnerabilities affecting every published version upnghttp2Node is a recent example. The fix for the vulnerability came bundled with a SEMVER-MAJOR update to the nghttp2 dependency and the removal of HTTP/2 priority signaling support. The vulnerable behavior and the featureNodeno fixed version to move to (and won’t ever be). Take request, one of the most-used HTTP clients in Node, that has been deprecated since 2020. And yet, it still turns up everywhere, usually dragged in by somenode-fetchSo in this instance, “upgrade” actually means ripping request out and moving to something like axios or node-fetch. That’s a rewrite and a migration, and it means that until someone has time for it, the CVE just sitsrequestThe first is when there’s no fixed version to move to (and won’t ever be). Take request, one of the most-used HTTP clients in Node, that has been deprecated since 2020. And yet, it still turns up everywhere, usually