{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@microsoft/api-extractor": {
      "name": "@microsoft/api-extractor",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@microsoft/api-extractor-model",
        "@microsoft/tsdoc-config",
        "@rushstack/node-core-library",
        "semver"
      ],
      "effects": [],
      "range": "7.9.1 - 7.45.1",
      "nodes": [
        "node_modules/ganache/node_modules/@microsoft/api-extractor"
      ],
      "fixAvailable": true
    },
    "@microsoft/api-extractor-model": {
      "name": "@microsoft/api-extractor-model",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@microsoft/tsdoc-config",
        "@rushstack/node-core-library"
      ],
      "effects": [
        "@microsoft/api-extractor"
      ],
      "range": "7.8.12 - 7.28.21",
      "nodes": [
        "node_modules/ganache/node_modules/@microsoft/api-extractor-model"
      ],
      "fixAvailable": true
    },
    "@microsoft/tsdoc-config": {
      "name": "@microsoft/tsdoc-config",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "ajv"
      ],
      "effects": [
        "@microsoft/api-extractor",
        "@microsoft/api-extractor-model"
      ],
      "range": "0.12.16 - 0.16.2",
      "nodes": [
        "node_modules/ganache/node_modules/@microsoft/tsdoc-config"
      ],
      "fixAvailable": true
    },
    "@rushstack/node-core-library": {
      "name": "@rushstack/node-core-library",
      "severity": "high",
      "isDirect": false,
      "via": [
        "semver"
      ],
      "effects": [
        "@microsoft/api-extractor-model"
      ],
      "range": "3.25.0 - 3.59.5",
      "nodes": [
        "node_modules/ganache/node_modules/@rushstack/node-core-library"
      ],
      "fixAvailable": true
    },
    "ajv": {
      "name": "ajv",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1113714,
          "name": "ajv",
          "dependency": "ajv",
          "title": "ajv has ReDoS when using `$data` option",
          "url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<6.14.0"
        }
      ],
      "effects": [
        "@microsoft/tsdoc-config"
      ],
      "range": "<6.14.0",
      "nodes": [
        "node_modules/ganache/node_modules/ajv"
      ],
      "fixAvailable": true
    },
    "bn.js": {
      "name": "bn.js",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1113441,
          "name": "bn.js",
          "dependency": "bn.js",
          "title": "bn.js affected by an infinite loop",
          "url": "https://github.com/advisories/GHSA-378v-28hj-76wf",
          "severity": "moderate",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=5.0.0 <5.2.3"
        },
        {
          "source": 1113442,
          "name": "bn.js",
          "dependency": "bn.js",
          "title": "bn.js affected by an infinite loop",
          "url": "https://github.com/advisories/GHSA-378v-28hj-76wf",
          "severity": "moderate",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<4.12.3"
        }
      ],
      "effects": [],
      "range": ">=5.0.0 <5.2.3 || <4.12.3",
      "nodes": [
        "node_modules/ganache/node_modules/asn1.js/node_modules/bn.js",
        "node_modules/ganache/node_modules/bn.js",
        "node_modules/ganache/node_modules/create-ecdh/node_modules/bn.js",
        "node_modules/ganache/node_modules/diffie-hellman/node_modules/bn.js",
        "node_modules/ganache/node_modules/miller-rabin/node_modules/bn.js",
        "node_modules/ganache/node_modules/public-encrypt/node_modules/bn.js"
      ],
      "fixAvailable": true
    },
    "brace-expansion": {
      "name": "brace-expansion",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1105443,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion Regular Expression Denial of Service vulnerability",
          "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
          "severity": "low",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 3.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=1.0.0 <=1.1.11"
        },
        {
          "source": 1115540,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
          "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.13"
        },
        {
          "source": 1123897,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
          "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<1.1.16"
        },
        {
          "source": 1130588,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
          "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.17"
        },
        {
          "source": 1130737,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.18"
        }
      ],
      "effects": [],
      "range": "<=1.1.17",
      "nodes": [
        "node_modules/ganache/node_modules/brace-expansion"
      ],
      "fixAvailable": true
    },
    "braces": {
      "name": "braces",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1098094,
          "name": "braces",
          "dependency": "braces",
          "title": "Uncontrolled resource consumption in braces",
          "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-1050"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.0.3"
        }
      ],
      "effects": [],
      "range": "<3.0.3",
      "nodes": [
        "node_modules/ganache/node_modules/braces"
      ],
      "fixAvailable": true
    },
    "browserify-sign": {
      "name": "browserify-sign",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1102445,
          "name": "browserify-sign",
          "dependency": "browserify-sign",
          "title": "browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack",
          "url": "https://github.com/advisories/GHSA-x9w5-v3q2-3rhw",
          "severity": "high",
          "cwe": [
            "CWE-347"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=2.6.0 <=4.2.1"
        }
      ],
      "effects": [],
      "range": "2.6.0 - 4.2.1",
      "nodes": [
        "node_modules/ganache/node_modules/browserify-sign"
      ],
      "fixAvailable": true
    },
    "browserslist": {
      "name": "browserslist",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1153171,
          "name": "browserslist",
          "dependency": "browserslist",
          "title": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM",
          "url": "https://github.com/advisories/GHSA-c83g-rgw3-j3cx",
          "severity": "high",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=4.28.6"
        },
        {
          "source": 1153172,
          "name": "browserslist",
          "dependency": "browserslist",
          "title": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)",
          "url": "https://github.com/advisories/GHSA-73wf-gq98-2v4g",
          "severity": "high",
          "cwe": [
            "CWE-248",
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=4.28.6"
        }
      ],
      "effects": [],
      "range": "<=4.28.6",
      "nodes": [
        "node_modules/ganache/node_modules/browserslist"
      ],
      "fixAvailable": true
    },
    "cipher-base": {
      "name": "cipher-base",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1109536,
          "name": "cipher-base",
          "dependency": "cipher-base",
          "title": "cipher-base is missing type checks, leading to hash rewind and passing on crafted data",
          "url": "https://github.com/advisories/GHSA-cpq7-6gpm-g9rc",
          "severity": "critical",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 9.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
          },
          "range": "<=1.0.4"
        }
      ],
      "effects": [],
      "range": "<=1.0.4",
      "nodes": [
        "node_modules/ganache/node_modules/cipher-base"
      ],
      "fixAvailable": true
    },
    "cross-spawn": {
      "name": "cross-spawn",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1104664,
          "name": "cross-spawn",
          "dependency": "cross-spawn",
          "title": "Regular Expression Denial of Service (ReDoS) in cross-spawn",
          "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.0.0 <7.0.5"
        }
      ],
      "effects": [],
      "range": "7.0.0 - 7.0.4",
      "nodes": [
        "node_modules/ganache/node_modules/cross-spawn"
      ],
      "fixAvailable": true
    },
    "diff": {
      "name": "diff",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1112704,
          "name": "diff",
          "dependency": "diff",
          "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
          "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
          "severity": "low",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=4.0.0 <4.0.4"
        },
        {
          "source": 1112705,
          "name": "diff",
          "dependency": "diff",
          "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
          "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
          "severity": "low",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=5.0.0 <5.2.2"
        }
      ],
      "effects": [
        "mocha"
      ],
      "range": "4.0.0 - 4.0.3 || 5.0.0 - 5.2.1",
      "nodes": [
        "node_modules/ganache/node_modules/diff",
        "node_modules/ganache/node_modules/ts-node/node_modules/diff"
      ],
      "fixAvailable": true
    },
    "js-yaml": {
      "name": "js-yaml",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1112715,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml has prototype pollution in merge (<<)",
          "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=4.0.0 <4.1.1"
        },
        {
          "source": 1121860,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
          "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68",
          "severity": "moderate",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=4.0.0 <=4.1.1"
        },
        {
          "source": 1123911,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption",
          "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.0"
        },
        {
          "source": 1138115,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported",
          "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.1"
        },
        {
          "source": 1193727,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
          "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.2"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.3.1",
      "nodes": [
        "node_modules/ganache/node_modules/js-yaml"
      ],
      "fixAvailable": true
    },
    "json5": {
      "name": "json5",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1096544,
          "name": "json5",
          "dependency": "json5",
          "title": "Prototype Pollution in JSON5 via Parse Method",
          "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
          },
          "range": ">=2.0.0 <2.2.2"
        }
      ],
      "effects": [],
      "range": "2.0.0 - 2.2.1",
      "nodes": [
        "node_modules/ganache/node_modules/json5"
      ],
      "fixAvailable": true
    },
    "micromatch": {
      "name": "micromatch",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1098681,
          "name": "micromatch",
          "dependency": "micromatch",
          "title": "Regular Expression Denial of Service (ReDoS) in micromatch",
          "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<4.0.8"
        }
      ],
      "effects": [],
      "range": "<4.0.8",
      "nodes": [
        "node_modules/ganache/node_modules/micromatch"
      ],
      "fixAvailable": true
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1096485,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch ReDoS vulnerability",
          "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.0.5"
        },
        {
          "source": 1113459,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.1.3"
        },
        {
          "source": 1113538,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
          "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.1.3"
        },
        {
          "source": 1113546,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
          "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.1.4"
        }
      ],
      "effects": [
        "mocha"
      ],
      "range": "<=3.1.3",
      "nodes": [
        "node_modules/ganache/node_modules/minimatch"
      ],
      "fixAvailable": true
    },
    "mocha": {
      "name": "mocha",
      "severity": "high",
      "isDirect": false,
      "via": [
        "diff",
        "js-yaml",
        "minimatch",
        "nanoid",
        "serialize-javascript"
      ],
      "effects": [],
      "range": "5.1.0 - 11.8.0",
      "nodes": [
        "node_modules/ganache/node_modules/mocha"
      ],
      "fixAvailable": true
    },
    "nanoid": {
      "name": "nanoid",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109563,
          "name": "nanoid",
          "dependency": "nanoid",
          "title": "Predictable results in nanoid generation when given non-integer values",
          "url": "https://github.com/advisories/GHSA-mwcw-c2x4-8c55",
          "severity": "moderate",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 4.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<3.3.8"
        },
        {
          "source": 1109578,
          "name": "nanoid",
          "dependency": "nanoid",
          "title": "Exposure of Sensitive Information to an Unauthorized Actor in nanoid",
          "url": "https://github.com/advisories/GHSA-qrpm-p2h7-hrv2",
          "severity": "moderate",
          "cwe": [
            "CWE-200",
            "CWE-704"
          ],
          "cvss": {
            "score": 5.5,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
          },
          "range": ">=3.0.0 <3.1.31"
        },
        {
          "source": 1138811,
          "name": "nanoid",
          "dependency": "nanoid",
          "title": "nanoid: non-secure generators can loop indefinitely with negative size",
          "url": "https://github.com/advisories/GHSA-28wg-ghj8-5hjv",
          "severity": "high",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.3.16"
        },
        {
          "source": 1139427,
          "name": "nanoid",
          "dependency": "nanoid",
          "title": "nanoid: custom generators can loop indefinitely when size is zero",
          "url": "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
          "severity": "high",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.3.18"
        },
        {
          "source": 1153189,
          "name": "nanoid",
          "dependency": "nanoid",
          "title": "nanoid: Integer Overflow or Wraparound",
          "url": "https://github.com/advisories/GHSA-xwg4-73v4-xw9w",
          "severity": "high",
          "cwe": [
            "CWE-190"
          ],
          "cvss": {
            "score": 7.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
          },
          "range": "<3.3.12"
        }
      ],
      "effects": [
        "mocha"
      ],
      "range": "<=3.3.17",
      "nodes": [
        "node_modules/ganache/node_modules/nanoid"
      ],
      "fixAvailable": true
    },
    "pbkdf2": {
      "name": "pbkdf2",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1105692,
          "name": "pbkdf2",
          "dependency": "pbkdf2",
          "title": "pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos",
          "url": "https://github.com/advisories/GHSA-h7cp-r72f-jxh6",
          "severity": "critical",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=3.0.10 <=3.1.2"
        },
        {
          "source": 1113204,
          "name": "pbkdf2",
          "dependency": "pbkdf2",
          "title": "pbkdf2 silently disregards Uint8Array input, returning static keys",
          "url": "https://github.com/advisories/GHSA-v62p-rq8g-8h59",
          "severity": "critical",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.0.0 <=3.1.2"
        }
      ],
      "effects": [],
      "range": "3.0.3 - 3.1.2",
      "nodes": [
        "node_modules/ganache/node_modules/pbkdf2"
      ],
      "fixAvailable": true
    },
    "picomatch": {
      "name": "picomatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1115549,
          "name": "picomatch",
          "dependency": "picomatch",
          "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
          "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<2.3.2"
        },
        {
          "source": 1115552,
          "name": "picomatch",
          "dependency": "picomatch",
          "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
          "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<2.3.2"
        }
      ],
      "effects": [],
      "range": "<=2.3.1",
      "nodes": [
        "node_modules/ganache/node_modules/picomatch"
      ],
      "fixAvailable": true
    },
    "semver": {
      "name": "semver",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1112921,
          "name": "semver",
          "dependency": "semver",
          "title": "semver vulnerable to Regular Expression Denial of Service",
          "url": "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.0.0 <7.5.2"
        }
      ],
      "effects": [
        "@microsoft/api-extractor",
        "@rushstack/node-core-library"
      ],
      "range": "7.0.0 - 7.5.1",
      "nodes": [
        "node_modules/ganache/node_modules/semver"
      ],
      "fixAvailable": true
    },
    "serialize-javascript": {
      "name": "serialize-javascript",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113686,
          "name": "serialize-javascript",
          "dependency": "serialize-javascript",
          "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
          "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
          "severity": "high",
          "cwe": [
            "CWE-96"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<=7.0.2"
        },
        {
          "source": 1119440,
          "name": "serialize-javascript",
          "dependency": "serialize-javascript",
          "title": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects",
          "url": "https://github.com/advisories/GHSA-qj8w-gfj5-8c6v",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-834"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=5.0.0 <7.0.5"
        },
        {
          "source": 1153196,
          "name": "serialize-javascript",
          "dependency": "serialize-javascript",
          "title": "Cross-site Scripting (XSS) in serialize-javascript",
          "url": "https://github.com/advisories/GHSA-76p7-773f-r4q5",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 5.4,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": ">=6.0.0 <6.0.2"
        }
      ],
      "effects": [
        "mocha",
        "terser-webpack-plugin"
      ],
      "range": "<=7.0.4",
      "nodes": [
        "node_modules/ganache/node_modules/serialize-javascript"
      ],
      "fixAvailable": true
    },
    "sha.js": {
      "name": "sha.js",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1109535,
          "name": "sha.js",
          "dependency": "sha.js",
          "title": "sha.js is missing type checks leading to hash rewind and passing on crafted data",
          "url": "https://github.com/advisories/GHSA-95m3-7q98-8xr5",
          "severity": "critical",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 9.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
          },
          "range": "<=2.4.11"
        }
      ],
      "effects": [],
      "range": "<=2.4.11",
      "nodes": [
        "node_modules/ganache/node_modules/sha.js"
      ],
      "fixAvailable": true
    },
    "terser-webpack-plugin": {
      "name": "terser-webpack-plugin",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "serialize-javascript"
      ],
      "effects": [],
      "range": "4.2.1 - 5.3.16",
      "nodes": [
        "node_modules/ganache/node_modules/terser-webpack-plugin"
      ],
      "fixAvailable": true
    },
    "validator": {
      "name": "validator",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109241,
          "name": "validator",
          "dependency": "validator",
          "title": "validator.js has a URL validation bypass vulnerability in its isURL function",
          "url": "https://github.com/advisories/GHSA-9965-vmph-33xx",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<13.15.20"
        },
        {
          "source": 1112713,
          "name": "validator",
          "dependency": "validator",
          "title": "Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements",
          "url": "https://github.com/advisories/GHSA-vghf-hv5q-vc2g",
          "severity": "high",
          "cwe": [
            "CWE-172",
            "CWE-792"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<13.15.22"
        }
      ],
      "effects": [],
      "range": "<=13.15.20",
      "nodes": [
        "node_modules/ganache/node_modules/validator"
      ],
      "fixAvailable": true
    },
    "webpack": {
      "name": "webpack",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1094471,
          "name": "webpack",
          "dependency": "webpack",
          "title": "Cross-realm object access in Webpack 5",
          "url": "https://github.com/advisories/GHSA-hc6q-2mpp-qw7j",
          "severity": "critical",
          "cwe": [],
          "cvss": {
            "score": 9.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=5.0.0 <5.76.0"
        },
        {
          "source": 1099351,
          "name": "webpack",
          "dependency": "webpack",
          "title": "Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS",
          "url": "https://github.com/advisories/GHSA-4vvj-4cpr-p986",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H"
          },
          "range": ">=5.0.0-alpha.0 <5.94.0"
        },
        {
          "source": 1113041,
          "name": "webpack",
          "dependency": "webpack",
          "title": "webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior",
          "url": "https://github.com/advisories/GHSA-8fgc-7cc6-rx7x",
          "severity": "low",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
          },
          "range": ">=5.49.0 <=5.104.0"
        },
        {
          "source": 1113042,
          "name": "webpack",
          "dependency": "webpack",
          "title": "webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects \u2192 SSRF + cache persistence",
          "url": "https://github.com/advisories/GHSA-38r7-794h-5758",
          "severity": "low",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
          },
          "range": ">=5.49.0 <5.104.0"
        }
      ],
      "effects": [],
      "range": "5.0.0-alpha.0 - 5.104.0",
      "nodes": [
        "node_modules/ganache/node_modules/webpack"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 1,
      "moderate": 5,
      "high": 17,
      "critical": 4,
      "total": 27
    },
    "dependencies": {
      "prod": 328,
      "dev": 173,
      "optional": 89,
      "peer": 0,
      "peerOptional": 0,
      "total": 500
    }
  }
}