# Vulnerability triage report — Orchard Gateway 4.2.0 (SAMPLE)

> Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

Scan date: 2026-01-01 · Scanner: SAMPLE fixture · Findings: 4

| Advisory | Package | Installed | Fixed in | Severity | Decision |
| --- | --- | --- | --- | --- | --- |
| NOVUS-SAMPLE-2026-0001 | `example-logger` | 3.4.1 | 3.5.0 | High (8.1) | Upgrade now — blocks release |
| NOVUS-SAMPLE-2026-0002 | `example-cache` | 0.9.2 | 0.9.5 | Critical (9.3) | Not affected — vulnerable path not reachable |
| NOVUS-SAMPLE-2026-0003 | `example-yaml-lite` | 1.1.7 | 1.2.0 | Medium (5.4) | Fixed in next scheduled release |
| NOVUS-SAMPLE-2026-0004 | `example-json-path` | 2.0.5 | 2.1.0 | Low (3.1) | Accepted risk — tracked, expires 2026-04-01 |

## How the decisions were reached

### NOVUS-SAMPLE-2026-0001 — `example-logger` 3.4.1

- Vulnerable range: `<3.5.0`, fixed in `3.5.0`.
- Weakness class: CWE-20. CVSS v3.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` (base 8.1).
- Reached through: `@orchard-example/router`, `@orchard-example/http-core`, `example-metrics`.
- Decision: Upgrade now — blocks release.

### NOVUS-SAMPLE-2026-0002 — `example-cache` 0.9.2

- Vulnerable range: `>=0.9.0 <0.9.5`, fixed in `0.9.5`.
- Weakness class: CWE-502. CVSS v3.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` (base 9.3).
- Reached through: `@orchard-example/gateway`.
- Decision: Not affected — vulnerable path not reachable.

### NOVUS-SAMPLE-2026-0003 — `example-yaml-lite` 1.1.7

- Vulnerable range: `<1.2.0`, fixed in `1.2.0`.
- Weakness class: CWE-400. CVSS v3.1 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` (base 5.4).
- Reached through: `example-cache`.
- Decision: Fixed in next scheduled release.

### NOVUS-SAMPLE-2026-0004 — `example-json-path` 2.0.5

- Vulnerable range: `<2.1.0`, fixed in `2.1.0`.
- Weakness class: CWE-770. CVSS v3.1 `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L` (base 3.1).
- Reached through: `@orchard-example/http-core`, `example-yaml-lite`.
- Decision: Accepted risk — tracked, expires 2026-04-01.

## Counts

| Severity | Findings |
| --- | --- |
| Critical | 1 |
| High | 1 |
| Medium | 1 |
| Low | 1 |