CVE remediation is shifting from a discovery problem to a triage and fix problem. AI models now find vulnerabilities faster than teams can validate them, while the NVD has stopped scoring most CVEs filed before March 2026, leaving severity data missing. The conventional fix, upgrading, often fails because maintainers rarely patch old releases, upgrades bring breaking changes (e.g. CVE-2026-48937 in Node's nghttp2 dependency removed HTTP/2 priority signaling), or reflexive updates expose teams to supply-chain attacks like the chalk/debug npm compromise. The piece argues that knowing your dependency tree via a live SBOM and backporting fixes to the pinned version already in production is a cleaner path than upgrading or migrating stacks, and promotes Aikido Libraries as a tool that automates such backports across npm, PyPI, and Maven.
Table of contents
TL;DRHow AI has accelerated CVE discovery and disclosureThe upgrade trapWhat CVE remediation in 2026 involvesHow Aikido Libraries solves the upgrade trapFAQQuestions this post answers
Why did the fix for CVE-2026-48937 in Node's nghttp2 dependency break things?
The fix shipped bundled with a SEMVER-MAJOR update to the nghttp2 dependency that removed HTTP/2 priority signaling entirely, because the vulnerable behavior and the removed feature came from the same underlying code. Anyone relying on setPriority or .priority() had to strip those calls out before the upgrade would even apply. Track dependency CVEs like this one on daily.dev before an upgrade forces unplanned rework.
Has the NVD stopped scoring CVEs?
Yes, the National Vulnerability Database has quietly stopped scoring most CVEs, shelving everything filed before March 2026 as Not Scheduled. This means the severity scores and reference data that vulnerability tools rely on for triage and prioritization are often missing, pushing teams to pull from multiple vulnerability sources instead of treating the NVD as complete. Developers relying on NVD scoring for triage can follow coverage gaps like this on daily.dev.
What is backporting a CVE fix and how is it different from upgrading?
Backporting means applying the specific fix for a vulnerability to the older version already in use, instead of upgrading to the release that contains the upstream fix. It closes the CVE without pulling in breaking changes, transitive dependency shifts, or a migration, unlike an upgrade which accepts everything else that shipped in that release too. Weighing backporting against upgrading is easier when you follow dependency security news on daily.dev.