From f82c252ea87374ec28b88e5481697ba4bcde4d6f Mon Sep 17 00:00:00 2001
From: sean wibisono <sean.wibisono@thetradedesk.com>
Date: Thu, 6 Aug 2026 14:14:41 +1000
Subject: [PATCH] UID2-7633: suppress CVE-2026-18446 in .trivyignore (exp
 2026-09-06)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fast-uri (npm) is present but not reachable from this service — see UID2-7633 for the impact assessment. Reachability alone determines suppress-vs-fix.
---
 .trivyignore | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.trivyignore b/.trivyignore
index 3aa85f54a..c7e804c1b 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -3,3 +3,9 @@
 # for more details
 # e.g. 
 # CVE-2022-3996
+
+# CVE-2026-18446 — fast-uri (npm) (HIGH).
+# Not exploitable here: package.json:71 pins fast-uri ^3.1.4 in overrides; lock resolves 3.1.4
+# only under ajv-formats/schema-utils. No source import.
+# See: UID2-7633
+CVE-2026-18446 exp:2026-09-06