blitzstrike 2.4.102 → 2.4.103

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.103] — 2026-09-17
+
+### Added — version-precise fingerprint-first (semver narrowing)
+
+- `watchlistCveMatches` / `live_recon` now narrow the suggested CVEs by the
+  detected VERSION, not just the product. Each version-aware CVE carries a
+  `fixed_in` (semver boundary) + `version_key`; a detected version >= `fixed_in`
+  is excluded as patched, so `live_recon` names the EXACT CVE for the running
+  version instead of the whole product family. Verified: Next.js 14.2.5 →
+  CVE-2025-29927 (affected) but not CVE-2024-34351 (patched 14.1.1); Next.js
+  15.3.0 → both excluded; unknown version → full product list (fallback).
+
 ## [2.4.102] — 2026-09-17
 
 ### Added — `broken_link_scan` (broken-link hijacking live detector)

package/dist/index.js

@@ -36189,18 +36189,41 @@ function watchlist() {
   const recommendation = `Prioritize the ${unsaturated.length} non-saturated classes (top: ${unsaturated.slice(0, 3).map((e) => e.cwe).join(", ")}) — high frequency + high payout + not yet saturated. Skip saturated/low-value classes (XSS/CSRF/open-redirect standalone) unless they chain into account takeover. FINGERPRINT FIRST: if the target stack matches a watchlist product (Next.js, Kibana, Langflow, Confluence/Jira, PAN-OS, Grafana), test that specific CVE — top EPSS/report CVEs: ${topCve}.`;
   return { cwe_frequency: entries, cve_watchlist, recommendation };
 }
-function watchlistCveMatches(techs, headers = {}, body = "") {
+function semverLt(a, b) {
+  const pa = a.replace(/^v/, "").split(/[-+.]/).map((x) => parseInt(x, 10) || 0);
+  const pb = b.replace(/^v/, "").split(/[-+.]/).map((x) => parseInt(x, 10) || 0);
+  for (let i = 0;i < Math.max(pa.length, pb.length); i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x !== y)
+      return x < y;
+  }
+  return false;
+}
+function watchlistCveMatches(techs, headers = {}, body = "", versions = []) {
   const { cve_watchlist } = loadWatchlist();
   const haystack = `${techs.join(" ")} ${Object.keys(headers).join(" ")} ${Object.values(headers).join(" ")} ${body}`.toLowerCase();
   return cve_watchlist.filter((c) => {
     const m = c.match;
     if (!m)
       return false;
+    let matched = false;
     try {
-      return new RegExp(m, "i").test(haystack);
+      matched = new RegExp(m, "i").test(haystack);
     } catch {
+      matched = false;
+    }
+    if (!matched)
       return false;
+    const fixedIn = c.fixed_in;
+    const vkey = c.version_key;
+    if (fixedIn && vkey) {
+      const v = versions.find((x) => x.product.toLowerCase().includes(vkey.toLowerCase()));
+      if (v?.version && !semverLt(v.version, fixedIn)) {
+        return false;
+      }
     }
+    return true;
   });
 }
 
@@ -36638,7 +36661,7 @@ async function liveRecon(target, includeActive = false) {
   const waf = detectWaf(root.headers, root.body);
   const techs = detectTech(root.headers, root.body);
   const versions = extractVersion(root.headers, root.body);
-  const suggestedCves = watchlistCveMatches(techs, root.headers, root.body);
+  const suggestedCves = watchlistCveMatches(techs, root.headers, root.body, versions);
   const { links, scripts } = crawlLinks(base, root.body);
   const { robots, sitemap } = await fetchRobotsAndSitemap(base);
   const allUrls = [...links, ...scripts, ...robots, ...sitemap];

package/intelligence/watchlist.json

@@ -181,7 +181,9 @@
       "epss": 1.0,
       "reports": 2669,
       "fingerprint": "Confluence (Server/Data Center) \u2014 /login.action, confluence headers",
-      "match": "confluence|login\\.action|atlassian"
+      "match": "confluence|login\\.action|atlassian",
+      "fixed_in": "7.13.0",
+      "version_key": "confluence"
     },
     {
       "cve": "CVE-2025-29927",
@@ -191,7 +193,9 @@
       "epss": 0.9962,
       "reports": 132,
       "fingerprint": "_next/static/chunks/ bundles; x-middleware-subrequest header",
-      "match": "_next/|__next|next\\.js|middleware"
+      "match": "_next/|__next|next\\.js|middleware",
+      "fixed_in": "15.2.3",
+      "version_key": "next"
     },
     {
       "cve": "CVE-2025-55182",
@@ -201,7 +205,9 @@
       "epss": 0.9956,
       "reports": 415,
       "fingerprint": "_next/ + Server Function / flight endpoints",
-      "match": "_next/|server function|react server|rsc"
+      "match": "_next/|server function|react server|rsc",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2025-3248",
@@ -211,7 +217,9 @@
       "epss": 0.9997,
       "reports": 29,
       "fingerprint": "/api/v1/validate/code \u2014 AI/agent tooling",
-      "match": "langflow|validate/code"
+      "match": "langflow|validate/code",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2024-34351",
@@ -221,7 +229,9 @@
       "epss": 0.0545,
       "reports": 50,
       "fingerprint": "Next.js Server Actions (Host header + relative redirect)",
-      "match": "_next/|server action"
+      "match": "_next/|server action",
+      "fixed_in": "14.1.1",
+      "version_key": "next"
     },
     {
       "cve": "CVE-2025-0133",
@@ -231,7 +241,9 @@
       "epss": 0.4352,
       "reports": 1990,
       "fingerprint": "GlobalProtect captive portal",
-      "match": "globalprotect|palo alto|pan-os|pan os"
+      "match": "globalprotect|palo alto|pan-os|pan os",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-0257",
@@ -241,7 +253,9 @@
       "epss": 0.8668,
       "reports": 27,
       "fingerprint": "GlobalProtect portal/gateway",
-      "match": "globalprotect|palo alto|pan-os|pan os"
+      "match": "globalprotect|palo alto|pan-os|pan os",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2025-4123",
@@ -251,7 +265,9 @@
       "epss": 0.9781,
       "reports": 220,
       "fingerprint": "Grafana path traversal + open redirect (Image Renderer)",
-      "match": "grafana|x-grafana"
+      "match": "grafana|x-grafana",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2021-20323",
@@ -261,7 +277,9 @@
       "epss": 0.3725,
       "reports": 107,
       "fingerprint": "Keycloak auth flows",
-      "match": "keycloak|kc-|realms/"
+      "match": "keycloak|kc-|realms/",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2018-5230",
@@ -271,7 +289,9 @@
       "epss": 0.3761,
       "reports": 4694,
       "fingerprint": "Jira /issuecollector custom fields",
-      "match": "jira|issuecollector|atlassian"
+      "match": "jira|issuecollector|atlassian",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-33461",
@@ -281,7 +301,9 @@
       "epss": 0.0028,
       "reports": 8,
       "fingerprint": "Kibana internal Fleet endpoints",
-      "match": "kibana|elastic|fleet"
+      "match": "kibana|elastic|fleet",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-49093",
@@ -291,7 +313,9 @@
       "epss": 0.002,
       "reports": 5,
       "fingerprint": "Kibana connectors / allowlist bypass",
-      "match": "kibana|elastic|connector"
+      "match": "kibana|elastic|connector",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-26938",
@@ -301,7 +325,9 @@
       "epss": 0.0025,
       "reports": 5,
       "fingerprint": "Kibana Workflows",
-      "match": "kibana|elastic|workflow"
+      "match": "kibana|elastic|workflow",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-33068",
@@ -311,7 +337,9 @@
       "epss": 0.0034,
       "reports": 5,
       "fingerprint": "repo .claude/settings.json",
-      "match": "\\.claude/settings"
+      "match": "\\.claude/settings",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2025-25297",
@@ -321,7 +349,9 @@
       "epss": 0.0062,
       "reports": 2,
       "fingerprint": "Label Studio S3 integration",
-      "match": "label ?studio|labelstudio|label-studio"
+      "match": "label ?studio|labelstudio|label-studio",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-33309",
@@ -331,7 +361,9 @@
       "epss": 0.0142,
       "reports": 6,
       "fingerprint": "Langflow multipart upload filename",
-      "match": "langflow"
+      "match": "langflow",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-45543",
@@ -341,7 +373,9 @@
       "epss": 0.0027,
       "reports": 5,
       "fingerprint": "Nextcloud Forms collaborator removal",
-      "match": "nextcloud|ocs-provider"
+      "match": "nextcloud|ocs-provider",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2017-15277",
@@ -351,7 +385,9 @@
       "epss": 0.1919,
       "reports": 5914,
       "fingerprint": "image processing (GIF upload)",
-      "match": "imagemagick|graphicsmagick"
+      "match": "imagemagick|graphicsmagick",
+      "fixed_in": null,
+      "version_key": null
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.102",
+  "version": "2.4.103",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {