When a CVE has no fix yet, confirm whether you are actually exposed, apply the mitigations the advisory gives, reduce what the component can reach, and set a date to review. Waiting without a plan is the only wrong answer. Many no fix situations are manageable with a few controls.
Read what the page says
A Gold CVE page shows a status badge and a fix version badge. On the example we reviewed, they read "not-fixed" and "Not Available". The description explains the flaw. The page also lists mitigation strategies with priorities, such as network segmentation and monitoring, though the text is generic and the advisory itself has the specifics.
Step 1: Are you exposed?
List where the component runs. Check version, configuration and whether the vulnerable feature is turned on. In the example, the attack vector in the CVSS vector string was local, which changes how likely remote exploitation is. Always read the vector, not just the score.
Step 2: Check exploitation signals
Look at EPSS for the current 30 day exploitation probability and check CISA's KEV catalog. FIRST notes that EPSS does not know your environment, so use it as one input. If a no fix CVE appears in KEV, treat it as urgent.
Step 3: Mitigate
Typical options, depending on the advisory:
- Disable the affected feature or plugin.
- Restrict network access to the component.
- Add input size or format limits at a proxy.
- Tighten permissions for the service account.
- Add detection for the specific behavior.
Test each change in staging first, since mitigations can break things.
Step 4: Consider replacing
If the project looks abandoned, or the flaw is deep in its design, plan a switch. Check alternatives for a maintained equivalent. This is slower, so start early.
Step 5: Track and revisit
Record the CVE, your exposure assessment, the mitigation and an owner. Set a review date, weekly for high risk and monthly otherwise. Watch the advisory and the project repository for a fix. When a fix lands, move to the normal upgrade path.
What to tell stakeholders
Say what is exposed, what you did, what remains and when you will check again. Avoid both panic and silence.
Where tooling helps
Reachability analysis can show whether your code calls the vulnerable function, which often downgrades a no fix CVE sharply. Safeguard offers this, along with policies that can block new use of an affected component. For a quick check of which packages carry known CVEs, use gold.safeguard.sh/scan.
Quick check
Can I just accept the risk?
Yes, if you record the reasoning, an owner and a review date. Acceptance without a date turns into forgetting.
Sources
Last reviewed: 19 October 2026.
