Managing vulnerabilities

Find, assess, and manage the vulnerabilities that N|Solid detects in the packages your applications load.

Find vulnerabilities in the N|Solid Console

Open the navigation menu (☰) and select Security to see the vulnerabilities found in your running processes. See Security for details on this view.

To be notified when N|Solid finds a new vulnerability, configure Vulnerability Notifications in Settings > Global Notifications.

Understand vulnerabilities

A vulnerability in your dependencies doesn't necessarily mean your application is insecure, but it shows where you need to pay attention. Evaluate each vulnerability, and follow the update instructions to keep your application secure and up to date.

Severity levels

Vulnerabilities are grouped by severity:

1. Critical: fix immediately. These issues can have severe consequences if exploited.
2. High: serious issues. Address them promptly to prevent exploitation.
3. Medium: less severe, but still evaluate and fix them within a reasonable time.
4. Low: lower risk, but don't ignore them, especially if they are easy to fix.

Evaluate vulnerabilities

When N|Solid finds a vulnerability, assess its impact on your application:

1. Review the details: understand the vulnerability and how it can affect your application.
2. Check the context: consider where the vulnerable package is used in your code and how likely it is to be exploited.
3. Set the priority: based on severity and impact, decide which vulnerabilities to address first.

Manage and mitigate vulnerabilities

Update dependencies

Whenever possible, follow the update instructions to fix the vulnerability. Update your dependencies regularly to get the latest security patches.

Temporary measures

If you can't fix a vulnerability right away, for example because it's in a transitive dependency, consider these temporary measures:

1. Apply workarounds: apply any recommended workarounds that reduce the risk until a fix is available.
2. Isolate the vulnerable component: if feasible, isolate it to limit the potential impact.
3. Monitor the vulnerability: watch for updates or changes in its status.
4. Limit exposure: restrict access to the vulnerable component to trusted users.

Transitive dependencies

For vulnerabilities in transitive (downstream) dependencies:

1. Check for updates: check regularly whether the dependency's maintainers have released a fix.
2. Report the issue: if no fix is available, open an issue with the maintainers and include the details of the vulnerability.
3. Consider alternatives: evaluate whether another library can replace the vulnerable dependency.

More information

For details on what N|Solid scans for and how, see Security.