--- title: Why upgrading to fix a CVE often makes things worse description: Upgrading a dependency to fix a CVE is the default advice, but it fails in three concrete ways: no fixed version exists (e.g., deprecated packages like... canonical: https://daily.dev/posts/why-upgrading-to-fix-a-cve-often-makes-things-worse-hkdp6zpd5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Why upgrading to fix a CVE often makes things worse | daily.dev og:description: Upgrading a dependency to fix a CVE is the default advice, but it fails in three concrete ways: no fixed version exists (e.g., deprecated packages like... og:url: https://daily.dev/posts/why-upgrading-to-fix-a-cve-often-makes-things-worse-hkdp6zpd5 og:image: https://api.daily.dev/og/posts/Hkdp6Zpd5.png og:image:alt: Why upgrading to fix a CVE often makes things worse og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Why upgrading to fix a CVE often makes things worse **[Aikido Security](https://daily.dev/sources/aikido-security)** · 7 min read · 0 upvotes · 0 comments ## Summary Upgrading a dependency to fix a CVE is the default advice, but it fails in three concrete ways: no fixed version exists (e.g., deprecated packages like `request`), the patched version hasn't shipped yet (e.g., lodash), or the fix ships alongside breaking changes that require a migration before you can even install it. Staying current also carries its own risk — the chalk and debug npm compromise showed that auto-updating pipelines can pull in malware within minutes. AI is compounding the problem by enabling faster chaining of medium-severity CVEs into critical exploits. Three industry approaches exist: screening at ingestion, migrating to a hardened replacement stack, or backporting the fix to the version already in use. The third option avoids both the breaking-change risk and the frozen-version CVE accumulation problem, and is what Aikido Libraries aims to automate. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did the CVE-2026-48937 fix for Node.js break existing HTTP/2 code? The fix removed HTTP/2 priority signaling support because it was bundled with a SEMVER-MAJOR update to the nghttp2 dependency, and the vulnerable behavior was part of the same underlying code as the removed feature. Developers had to grep their codebase for setPriority and .priority() calls and remove them before they could apply the upgrade at all. _daily.dev surfaces breaking-change details like this so teams patching CVEs aren't blindsided mid-upgrade._ ### What happened with the chalk and debug npm packages being compromised? Attackers compromised a maintainer account behind chalk and debug, two npm packages with a combined two billion downloads per week, and published malicious versions through the official npm channel. Pipelines configured to auto-update pulled the malicious versions in automatically, meaning teams following standard best practice of staying current shipped malware within minutes. _Developers weighing auto-update policies against supply-chain risk can track incidents like this on daily.dev._ ### Why can't I just upgrade a package to fix a flagged CVE? Upgrading fails in three common scenarios: there is no fixed version and never will be (e.g. the deprecated Node request package, where the CVE advisory says the flaw affects every version since none are maintained), the patched version hasn't shipped yet (lodash had disclosed CVEs against its latest release with no fix available), or the fix ships bundled with breaking changes that require code migration before upgrading is even possible. _Teams stuck choosing between security debt and breaking changes can follow dependency-upgrade tradeoffs on daily.dev._ ## Similar posts on daily.dev - [Software dependencies are running away from us](https://daily.dev/posts/software-dependencies-are-running-away-from-us-8ly2du4kw) · InfoWorld · 0 upvotes · 0 comments - [What is CVE remediation in 2026?](https://daily.dev/posts/what-is-cve-remediation-in-2026--dnz1o8p3y) · Aikido Security · 0 upvotes · 0 comments - [Update or not, that is the question](https://daily.dev/posts/update-or-not-that-is-the-question-uxpgdh4sj) · ITNEXT · 0 upvotes · 0 comments - [Rethinking Application Updates: Solutions for Faster, More Efficient CVE Patching](https://daily.dev/posts/rethinking-application-updates-solutions-for-faster-more-efficient-cve-patching-slmtnkace) · SD Times · 0 upvotes · 0 comments - [The Dependency You Didn’t Choose](https://daily.dev/posts/the-dependency-you-didn-t-choose-cfixvbzyc) · Tech Lead Digest · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/why-upgrading-to-fix-a-cve-often-makes-things-worse-hkdp6zpd5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Why upgrading to fix a CVE often makes things worse","url":"https://daily.dev/posts/why-upgrading-to-fix-a-cve-often-makes-things-worse-hkdp6zpd5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/why-upgrading-to-fix-a-cve-often-makes-things-worse-hkdp6zpd5"},"datePublished":"2026-07-22T14:53:46.626Z","dateModified":"2026-09-14T07:39:27.044Z","description":"Upgrading a dependency to fix a CVE is the default advice, but it fails in three concrete ways: no fixed version exists (e.g., deprecated packages like...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c7f62f3dd207fff4bdb5ed856fd4d76c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c7f62f3dd207fff4bdb5ed856fd4d76c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/why-upgrading-to-fix-a-cve-often-makes-things-worse-hkdp6zpd5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,appsec","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"Why upgrading to fix a CVE often makes things worse"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/why-upgrading-to-fix-a-cve-often-makes-things-worse-hkdp6zpd5#faq","mainEntity":[{"@type":"Question","name":"Why did the CVE-2026-48937 fix for Node.js break existing HTTP/2 code?","acceptedAnswer":{"@type":"Answer","text":"The fix removed HTTP/2 priority signaling support because it was bundled with a SEMVER-MAJOR update to the nghttp2 dependency, and the vulnerable behavior was part of the same underlying code as the removed feature. Developers had to grep their codebase for setPriority and .priority() calls and remove them before they could apply the upgrade at all. daily.dev surfaces breaking-change details like this so teams patching CVEs aren't blindsided mid-upgrade."}},{"@type":"Question","name":"What happened with the chalk and debug npm packages being compromised?","acceptedAnswer":{"@type":"Answer","text":"Attackers compromised a maintainer account behind chalk and debug, two npm packages with a combined two billion downloads per week, and published malicious versions through the official npm channel. Pipelines configured to auto-update pulled the malicious versions in automatically, meaning teams following standard best practice of staying current shipped malware within minutes. Developers weighing auto-update policies against supply-chain risk can track incidents like this on daily.dev."}},{"@type":"Question","name":"Why can't I just upgrade a package to fix a flagged CVE?","acceptedAnswer":{"@type":"Answer","text":"Upgrading fails in three common scenarios: there is no fixed version and never will be (e.g. the deprecated Node request package, where the CVE advisory says the flaw affects every version since none are maintained), the patched version hasn't shipped yet (lodash had disclosed CVEs against its latest release with no fix available), or the fix ships bundled with breaking changes that require code migration before upgrading is even possible. Teams stuck choosing between security debt and breaking changes can follow dependency-upgrade tradeoffs on daily.dev."}}]} ```