npm/lockfile-lint-api CVE-2025-4759: high 8.3, EPSS 0.44%

lockfile-lint-api Vulnerable to Incorrect Behavior Order

Action: Upgrade lockfile-lint-api to 5.9.2 or later.

npm i lockfile-lint-api@5.9.2

Affected

Fixed versions

Sources

• osv: GHSA-7cfr-5cjf-32p4
• https://nvd.nist.gov/vuln/detail/CVE-2025-4759
• https://github.com/lirantal/lockfile-lint/pull/204
• https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca
• https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f
• https://github.com/lirantal/lockfile-lint
• https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js#L51-L63
• https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587

CVE-2025-4759 · published 2025-05-16T06:30:24Z · modified 2025-05-16T22:12:11.442481Z · JSON