# Use of Unmaintained Third Party Components (CWE-1104)

The product relies on third-party components that are no longer being maintained by the original developer or by the open source community.

**Stack:** JavaScript

- Prevalence: 中 2 言語をカバー
- Impact: ミディアム レビュー推奨
- Prevention: 文書化済み 5 件の修正例

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

Without ongoing maintenance, newly discovered vulnerabilities in these components will not be patched. This creates an increasing risk as time passes and vulnerabilities are discovered.

## Prevention

2 件の Shoulder 検出ルールに基づく Use of Unmaintained Third Party の予防策。

### JavaScript

Update .nvmrc to a supported Node.js LTS version (22 or 20)

Align Node.js versions across .nvmrc, Dockerfile, and package.json to the same LTS version

## Warning Signs

- [MEDIUM] .nvmrc specifies ...
- [MEDIUM] Node.js versions are inconsistent across configuration files. Check the docker-image-outdated finding for the latest rec
- [MEDIUM] inconsistent Node

## Consequences

- 未承認コードの実行
- アプリケーションデータの読み取り
- DoS

## Mitigations

- サードパーティ依存関係を定期的に監査し更新する
- コンポーネントの脆弱性を監視するプロセスを確立する
- メンテナンスされていないコンポーネントを置き換える計画を用意する

## Detection

- Total rules: 5
- Languages: dockerfile, javascript

## Rules by Language

### Javascript (2 rules)

- **.nvmrc Specifies Outdated Node.js Version** [MEDIUM]: Detects .nvmrc files specifying outdated or end-of-life (EOL) Node.js versions.

The .nvmrc file is used by Node Version Manager (nvm) to automatically switch
to the correct Node.js version for a project. When this file specifies an
outdated version, developers may be running insecure or incompatible Node.js
versions in their development environments.

Node.js version lifecycle (as of 2025):
- Node 14.x: EOL April 2023
- Node 16.x: EOL September 2023
- Node 18.x: EOL April 2025
- Node 20.x: Main
  - Remediation: Update .nvmrc to a supported Node.js LTS version (20.x or 22.x).
- **Node.js Version Mismatch Between Configuration Files** [MEDIUM]: Detects inconsistent Node.js versions across project configuration files.

When .nvmrc specifies one Node.js version but Dockerfile uses a different
version, it causes environment drift:

- "Works on my machine" bugs (code works locally but fails in production)
- Security inconsistencies (development may use patched version while
  production uses vulnerable version)
- Dependency incompatibilities (npm packages may behave differently)
- Debugging difficulties (hard to reproduce production issues
  - Remediation: Align ALL configuration files to use the SAME Node.js version.

IMPORTANT: Check the docker-image-outdated finding for the LATEST version.
The API provides real-time version recommendations.

After determining the latest version from docker-image-outdated, update:
  - Dockerfile: FROM node:<version>-alpine
  - .nvmrc: <version>
  - package.json engines.node: ">=<version>.0.0"

NEVER downgrade. Always use the NEWER version shown in docker-image-outdated.