--- title: TSU-06 Outdated or End-of-Life Components in Mendix | Omnext description: Runtime versions, Marketplace modules, Java and JavaScript libraries all age. How to keep an SBOM of a Mendix app and catch what composition scanning misses. image: https://www.omnext.com/hubfs/raw_assets/public/Cerios%20Solutions%20Theme%20-%20Omnext/omx-sept-2026/images/omx-og-default.png --- [![Omnext](https://www.omnext.com/hubfs/Omnext/Omnext%20-%20Logo%20+%20Slogan.svg)](https://www.omnext.com?hsLang=en) [Platform](https://www.omnext.com/mendix-quality-analysis?hsLang=en) [Mendix quality analysisMaintainability, architecture and technical debt, scored every sprint.](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix security analysisThe S-Unit Top 10, checked automatically on every build.](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio ProFindings in the IDE, while the developer is still in the model.](https://www.omnext.com/devassist?hsLang=en)[Omnext MCPAll analysis data, ready for your AI agents and assistants.](https://www.omnext.com/omnext-mcp?hsLang=en) [Pricing](https://www.omnext.com/pricing?hsLang=en) [Resources](https://www.omnext.com/resources?hsLang=en) [Knowledge baseThe full product documentation, for everyone who works with Omnext.](https://help.omnext.com/?hsLang=en)[Fact sheetsQuality and security analysis for Mendix, in two short PDFs.](https://www.omnext.com/fact-sheet-request?hsLang=en)[Mendix security self-assessmentTen questions, five minutes, your security profile on screen.](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity ScanWhere your Center of Excellence stands today.](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[NIS2 readiness checklistTwenty-four items, your readiness score on screen.](https://www.omnext.com/nis2-readiness-checklist-mendix?hsLang=en)[The S-Unit Top 10Ten Mendix-specific security categories, explained.](https://www.omnext.com/s-unit-top-10?hsLang=en)[BlogArticles on Mendix quality, security and governance.](https://www.omnext.com/blog?hsLang=en)[Trust CenterHosting, data handling and certifications.](https://www.omnext.com/trust-center?hsLang=en)[All resourcesEverything in one overview.](https://www.omnext.com/resources?hsLang=en) [Partners](https://www.omnext.com/partners?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en) Search [Log in](https://portal.omnext.net/)[Request a demo](https://www.omnext.com/demo?hsLang=en) Menu [Platform](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix quality analysis](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix security analysis](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio Pro](https://www.omnext.com/devassist?hsLang=en)[Omnext MCP](https://www.omnext.com/omnext-mcp?hsLang=en)[Pricing](https://www.omnext.com/pricing?hsLang=en)[Resources](https://www.omnext.com/resources?hsLang=en)[Knowledge base](https://help.omnext.com/?hsLang=en)[Fact sheets](https://www.omnext.com/fact-sheet-request?hsLang=en)[Mendix security self-assessment](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity Scan](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[NIS2 readiness checklist](https://www.omnext.com/nis2-readiness-checklist-mendix?hsLang=en)[The S-Unit Top 10](https://www.omnext.com/s-unit-top-10?hsLang=en)[Blog](https://www.omnext.com/blog?hsLang=en)[Trust Center](https://www.omnext.com/trust-center?hsLang=en)[All resources](https://www.omnext.com/resources?hsLang=en)[Partners](https://www.omnext.com/partners?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en) [Request a demo](https://www.omnext.com/demo?hsLang=en)[Log in](https://portal.omnext.net/) S-Unit Top 10 · TSU-06 # Outdated or end-of-life components A Mendix application is assembled from parts that age: the runtime, Marketplace modules, the Java libraries behind them and the JavaScript inside widgets. Once a vulnerability in any of those is public, exploitation is largely automated, so the exposure is not the flaw itself but the time you take to notice it. [Take the free security self-check](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[All ten categories](https://www.omnext.com/s-unit-top-10?hsLang=en) Where it goes wrong ## How this shows up in a Mendix application. ### A runtime outside MTS or LTS Running a version that is neither medium nor long term supported, which also invites breaking changes at the worst moment. ### Marketplace modules edited in place Changing a module directly blocks every future update, so the security fixes never arrive. ### No SBOM Nobody can say which components are actually in the application, so nobody can say whether the latest advisory applies. ### Composition scanning taken as complete The Mendix Software Composition Service does not see minified JavaScript libraries or embedded JAR files, and those are where the old versions hide. ### Direct role assignments inside modules Security logic left inside a Marketplace module ties your role model to somebody else's release schedule. ### Known-vulnerable components left in place Components with published issues, such as older ForgotPassword, Encryption or SAML modules, or an outdated CKEditor or jQuery. Impact ## What it lets someone do. Every item below has been found in production applications. None of them requires a sophisticated attacker: they require somebody who reads the page source, edits a request or simply logs in. Take over a session through cross-site scripting in an outdated front-end library Execute code through a vulnerable Java component Bypass a security control that an old Marketplace module was supposed to provide Escalate privileges through a known runtime issue, including around XPath constraints Prevention ## How to keep it out. ### Keep a current SBOM One inventory covering runtime, modules, JAR files and JavaScript, refreshed automatically rather than at audit time. ### Stay on MTS or LTS Run a supported runtime and plan the upgrade before support ends, not after an advisory forces it. ### Extend, never edit Custom behaviour in a separate module, so Marketplace updates remain a decision rather than a merge. Automated ## What Omnext checks for you. Omnext builds the SBOM per application and per portfolio, matches components against known CVEs with their exploit probability, and flags licence risk alongside it. [See the security analysis](https://www.omnext.com/mendix-security-analysis?hsLang=en) Source ## The framework is The S-Unit's. The S-Unit Top 10 is the work of The S-Unit, the Mendix security specialists. They built it from more than ten years of offensive security work and hundreds of Mendix penetration tests, and they maintain the canonical version. Omnext automates the checks in the Security Analysis module; the framework itself is theirs, and this page explains it in our own words. [Read the original on the-s-unit.nl](https://the-s-unit.nl/en/tsu-06-use-of-outdated-or-end-of-life-components/) Keep reading ## The rest of the S-Unit Top 10. Ten categories in total. [See the full list](https://www.omnext.com/s-unit-top-10?hsLang=en). [TSU-05Insecure consumption of integrations](https://www.omnext.com/tsu-05-insecure-consumption-of-integrations?hsLang=en) [TSU-07Insecure custom authentication](https://www.omnext.com/tsu-07-insecure-custom-authentication?hsLang=en) Next step ## Which of the ten are you sure about? Ten questions, about five minutes, results on screen. Or let the scan answer all ten with evidence from your own model. [Take the self-check](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[Request a demo](https://www.omnext.com/demo?hsLang=en) ![Omnext](https://www.omnext.com/hubfs/Omnext/Omnext%20-%20Logo%20-%20Inverted.svg) Automated quality and security analysis for Mendix. Build Fast. Stay in Control. ISO 27001:2023GDPRHosted on Azure (EU) Platform[Quality Analysis for Mendix](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Security Analysis (SAST)](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio Pro](https://www.omnext.com/devassist?hsLang=en)[Omnext MCP](https://www.omnext.com/omnext-mcp?hsLang=en)[Pricing](https://www.omnext.com/pricing?hsLang=en) Resources[Fact sheets](https://www.omnext.com/fact-sheet-request?hsLang=en)[Security Self-Assessment](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity Scan](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[Blog](https://www.omnext.com/blog?hsLang=en)[Knowledge base](https://help.omnext.com/?hsLang=en)[All resources](https://www.omnext.com/resources?hsLang=en) Company[Partners](https://www.omnext.com/partners?hsLang=en)[Trust Center](https://www.omnext.com/trust-center?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en)[Request a demo](https://www.omnext.com/demo?hsLang=en) ContactCerios | Omnext B.V. Orteliuslaan 1000 3528 BD Utrecht, The Netherlands[contact@omnext.com](mailto:contact@omnext.com)[LinkedIn](https://www.linkedin.com/company/omnext/) © 2026 Cerios | Omnext B.V. · part of Cerios Solutions · KvK 09115372[Privacy policy](https://www.omnext.com/privacy-policy?hsLang=en)[Security & disclosure](https://www.omnext.com/trust-center?hsLang=en)