What should you do when an SCA report says no fix is available?

When an SCA report says no fix is available, do not leave the finding unowned. Check whether the vulnerable code is reachable, whether the flaw is known exploited, apply a mitigation if one exists, record the decision with a review date, and watch for a patch. No fix means no upgrade, not no action.

What "no fix" can mean

The label covers several different situations, and the right response differs.

The OSV schema notes that when no fixed version is recorded, the last_affected field is the ceiling of the vulnerability at the time of publication, and warns that this can create false negatives, which is why a fixed version is strongly preferred. A missing fixed version is a signal to read the advisory text, not to assume the worst or the best.

Six steps

1. Read the advisory. The details field or linked advisory often names a workaround, such as disabling a feature or setting a config option.
2. Check reachability. If your code never calls the vulnerable function, the real exposure may be low. The Go vulnerability tooling is a useful illustration: its tutorial output marks a vulnerability as informational when your code has no call stack to it, and says you may not need to take action.
3. Check exploit signals. Is it on the Known Exploited Vulnerabilities list? What is its exploit probability score?
4. Mitigate. Options include removing the feature, restricting input at a gateway, pinning to a version outside the affected range if one exists, or isolating the component.
5. Record the decision. Write who decided, what the reasoning was, what mitigation is in place, and when to review.
6. Watch and revisit. Subscribe to the advisory and recheck on the review date.

What a good record looks like

A short entry beats a long one: finding ID, package and version, reasoning, mitigation, owner, review date. When an auditor or customer asks why an open finding exists, the record is the answer.

When to replace the package

If the package is unmaintained and the flaw is reachable, replacing it is often the only durable fix. That is a planned project, so put it on the roadmap with an owner rather than leaving it as a permanent exception.

Try it yourself

Click through it at your own pace, or open it full screen. Check how exploitability changes what you do about a finding with no patch.

Where Safeguard fits

Safeguard's reachability analysis and policies help you decide on unpatched findings, and zero-day discovery covers cases where a patch does not exist yet.

Quick check

Sources

• OSV schema
• Go, Tutorial: Find and fix vulnerable dependencies with govulncheck
• CISA, Known Exploited Vulnerabilities

Last reviewed: 19 October 2026.