A bundled dependency is a third-party library packaged inside an application or runtime instead of being provided by the operating system. The application uses that included copy, which may have its own version and update process.
This matters in cybersecurity because updating a system-wide library may not fix a vulnerable copy bundled with an application. In real attacks, malicious or malformed input can reach a flaw in that embedded library-for example, compressed network data processed by an outdated decoder. Defenders should identify which copy the application actually loads, check package versions and vendor updates, and restart affected processes after patching.