{"id":"ROOT-APP-NPM-CVE-2026-0000","summary":"CVE-2026-0000 in react-leaflet-heatmap-layer - Patched by Root","details":"Root has patched CVE-2026-0000 in the react-leaflet-heatmap-layer package for Root:npm. Multiple fixed versions available.","modified":"2026-08-31T16:45:04.336688625Z","published":"2026-08-31T15:24:06Z","upstream":["CVE-2026-0000"],"database_specific":{"distro_version":"","severity":"CRITICAL","source":"Root","distro":"npm"},"affected":[{"package":{"name":"react-leaflet-heatmap-layer","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-aikido.2"}]}],"database_specific":{"upstream_version":"2.0.0","source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json","all_fixed_versions":["2.0.0-aikido.2"],"root_patch_version":"aikido.2","root_patched":true,"total_fixed_versions":1}},{"package":{"name":"@emilgroup/billing-sdk","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56.0-aikido.2"},{"fixed":"1.57.0-aikido.2"}]}],"database_specific":{"source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json","all_fixed_versions":["1.56.0-aikido.2","1.57.0-aikido.2"],"root_patch_version":"aikido.2","root_patched":true,"total_fixed_versions":2,"upstream_version":"1.57.0"}},{"package":{"name":"@emilgroup/customer-sdk","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.54.0-aikido.2"}]}],"database_specific":{"total_fixed_versions":1,"upstream_version":"1.54.0","all_fixed_versions":["1.54.0-aikido.2"],"root_patch_version":"aikido.2","source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json","root_patched":true}},{"package":{"name":"@emilgroup/insurance-sdk","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.98.0-aikido.3"},{"fixed":"1.97.0-aikido.3"}]}],"database_specific":{"total_fixed_versions":2,"upstream_version":"1.97.0","source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json","all_fixed_versions":["1.98.0-aikido.3","1.97.0-aikido.3"],"root_patch_version":"aikido.3","root_patched":true}},{"package":{"name":"@opengov/ppf-backend-types","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.141.1-aikido.2"},{"fixed":"1.141.3-aikido.3"}]}],"database_specific":{"source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json","all_fixed_versions":["1.141.1-aikido.2","1.141.3-aikido.3"],"root_patch_version":"aikido.3","root_patched":true,"total_fixed_versions":2,"upstream_version":"1.141.3"}},{"package":{"name":"axios","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-aikido.3"},{"fixed":"1.14.0-aikido.4"},{"fixed":"1.14.0-aikido.5"},{"fixed":"1.14.0-aikido.6"},{"fixed":"1.14.0-aikido.7"},{"fixed":"1.14.0-aikido.8"},{"fixed":"1.14.0-aikido.9"},{"fixed":"1.14.0-aikido.10"},{"fixed":"1.14.0-aikido.11"}]}],"database_specific":{"total_fixed_versions":9,"source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json","upstream_version":"1.14.0","all_fixed_versions":["1.14.0-aikido.3","1.14.0-aikido.4","1.14.0-aikido.5","1.14.0-aikido.6","1.14.0-aikido.7","1.14.0-aikido.8","1.14.0-aikido.9","1.14.0-aikido.10","1.14.0-aikido.11"],"root_patch_version":"aikido.11","root_patched":true}},{"package":{"name":"@rootio/react-leaflet-heatmap-layer","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-root.io.2"},{"fixed":"2.0.0-root.io.1"}]}],"database_specific":{"upstream_version":"2.0.0","all_fixed_versions":["2.0.0-root.io.2","2.0.0-root.io.1"],"root_patch_version":"root.io.2","root_patched":true,"total_fixed_versions":2,"source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json"}},{"package":{"name":"@rootio/opengov__ppf-backend-types","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.141.3-root.io.1"},{"fixed":"1.141.3-root.io.2"},{"fixed":"1.141.1-root.io.1"},{"fixed":"1.141.1-root.io.2"},{"fixed":"1.141.3-root.io.3"}]}],"database_specific":{"all_fixed_versions":["1.141.3-root.io.1","1.141.3-root.io.2","1.141.1-root.io.1","1.141.1-root.io.2","1.141.3-root.io.3"],"root_patch_version":"root.io.3","root_patched":true,"total_fixed_versions":5,"upstream_version":"1.141.3","source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json"}},{"package":{"name":"@rootio/emilgroup__billing-sdk","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56.0-root.io.1"},{"fixed":"1.57.0-root.io.1"},{"fixed":"1.56.0-root.io.2"},{"fixed":"1.57.0-root.io.2"}]}],"database_specific":{"all_fixed_versions":["1.56.0-root.io.1","1.57.0-root.io.1","1.56.0-root.io.2","1.57.0-root.io.2"],"root_patch_version":"root.io.2","root_patched":true,"total_fixed_versions":4,"source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json","upstream_version":"1.57.0"}},{"package":{"name":"@rootio/opengov__form-renderer","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.19-root.io.1"}]}],"database_specific":{"source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json","upstream_version":"0.2.19","all_fixed_versions":["0.2.19-root.io.1"],"root_patch_version":"root.io.1","root_patched":true,"total_fixed_versions":1}},{"package":{"name":"@rootio/emilgroup__insurance-sdk","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.97.0-root.io.1"},{"fixed":"1.98.0-root.io.1"},{"fixed":"1.97.0-root.io.2"},{"fixed":"1.98.0-root.io.2"},{"fixed":"1.98.0-root.io.3"},{"fixed":"1.97.0-root.io.3"}]}],"database_specific":{"total_fixed_versions":6,"upstream_version":"1.97.0","source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json","all_fixed_versions":["1.97.0-root.io.1","1.98.0-root.io.1","1.97.0-root.io.2","1.98.0-root.io.2","1.98.0-root.io.3","1.97.0-root.io.3"],"root_patch_version":"root.io.3","root_patched":true}},{"package":{"name":"@rootio/opengov__form-builder","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.2-root.io.1"},{"fixed":"0.13.0-root.io.1"}]}],"database_specific":{"total_fixed_versions":2,"upstream_version":"0.13.0","source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json","all_fixed_versions":["0.12.2-root.io.1","0.13.0-root.io.1"],"root_patch_version":"root.io.1","root_patched":true}},{"package":{"name":"@rootio/emilgroup__customer-sdk","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.54.0-root.io.1"},{"fixed":"1.54.0-root.io.2"}]}],"database_specific":{"upstream_version":"1.54.0","all_fixed_versions":["1.54.0-root.io.1","1.54.0-root.io.2"],"source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json","root_patch_version":"root.io.2","root_patched":true,"total_fixed_versions":2}},{"package":{"name":"@rootio/axios","ecosystem":"Root:npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-root.io.1"},{"fixed":"1.14.0-root.io.3"},{"fixed":"1.14.0-root.io.4"},{"fixed":"1.14.0-root.io.5"},{"fixed":"1.14.0-root.io.6"},{"fixed":"1.14.0-root.io.7"},{"fixed":"1.14.0-root.io.8"},{"fixed":"1.14.0-root.io.9"},{"fixed":"1.14.0-root.io.10"},{"fixed":"1.14.0-root.io.11"}]}],"database_specific":{"all_fixed_versions":["1.14.0-root.io.1","1.14.0-root.io.3","1.14.0-root.io.4","1.14.0-root.io.5","1.14.0-root.io.6","1.14.0-root.io.7","1.14.0-root.io.8","1.14.0-root.io.9","1.14.0-root.io.10","1.14.0-root.io.11"],"root_patch_version":"root.io.11","root_patched":true,"total_fixed_versions":10,"upstream_version":"1.14.0","source":"https://api.root.io/external/osv/ROOT-APP-NPM-CVE-2026-0000.json"}}],"schema_version":"1.9.0"}