The EOL Blind Spot in Your CVE Feed: What SCA Tools Don't Check

HeroDevs’ EOL DS tool reveals that most SCA scanners miss end‑of‑life (EOL) dependencies, leaving thousands of vulnerable packages unflagged.

The tool tracks over 12 million package versions across npm, PyPI, Maven, NuGet, Cargo, RubyGems, Go, Packagist, and crates.io, and finds that 5.4 million of those are EOL, a figure far larger than the ~7 000 versions reported by endoflife.date. Among the exposed packages, 81 000 EOL versions have known CVEs with no available fix path, and HeroDevs estimates the true number of vulnerable EOL packages could exceed 400 000.

The report cites Spring Security CVE‑2026‑22732 as a concrete example: the official CVE range lists Spring Security 5.7.x‑7.0.x, but the EOL 6.2.x version, used in Spring Boot 3.2, is also affected and was not flagged by scanners. HeroDevs has back‑ported a fix for its NES customers and confirmed that 80 % of CVEs disclosed on supported versions also affect uninvestigated EOL versions. The problem is compounded by the rapid growth of package releases—over 838 000 critical‑score releases on npm in 2025—and by AI‑driven vulnerability research that can uncover flaws in abandoned code without triggering official advisories.

The solution offered is a free EOL scan that can be run via CLI or by uploading an SBOM, which identifies both announced and abandoned packages across all major registries. Organizations should not treat scanner silence as safety; a clean scan simply indicates the package was not checked, not that it is secure.