A NowSecure scan reports **Components with Known Vulnerabilities** for `libz.1.dylib` (`zlib` `1.2.12`) in our iOS app binary built with Firebase iOS SDK.

A NowSecure scan reports **Components with Known Vulnerabilities** for `libz.1.dylib` (`zlib` `1.2.12`) in our iOS app binary built with Firebase iOS SDK.

### What we are seeing
- Finding ID: `3246948`
- Library: `libz.1.dylib`
- Version: `1.2.12`
- CPE: `cpe:2.3:a:zlib:zlib:1.2.12:*:*:*:*:*:*:*`
- Total CVEs detected: `4`
- Highest CVSS: `9.8`
- Scanner category: `Code Quality, App Store Blocker`
- Status: `Detected`

CVEs reported by scanner:
- `CVE-2022-37434` (9.8)
- `CVE-2023-45853` (9.8)
- `CVE-2026-22184` (7.8)
- `CVE-2026-27171` (5.5)

### Environment
- Firebase iOS SDK: latest
- Xcode: 26.6
- Installation method: Swift Package Manager
- Platform: iOS
- Build config: Release

### Question / help needed
Please help confirm:
1. Is `libz.1.dylib`/zlib in this case introduced by Firebase SDK (directly or transitively), or by Apple toolchain/runtime packaging?
2. Is there a recommended mitigation/remediation for this finding when using latest Firebase SDK?
3. If this is not actionable from Firebase side, can you share official guidance we can use for AppSec exception documentation?

### Repro
1. Build iOS app with latest Firebase iOS SDK on Xcode 26.6 (Release)
2. Scan app package with NowSecure
3. Observe vulnerability finding for `libz.1.dylib` version `1.2.12`

### Privacy note
Please avoid asking for public app-identifying details. I can share sanitized diagnostics privately.
### Reproducing the issue

Build app from in Release
Use latest Firebase iOS SDK
Build with Xcode 26.6
Run NowSecure scan
Observe finding for libz.1.dylib version 1.2.12 (4 CVEs, highest 9.8)

### Firebase SDK Version

26.6

### Xcode Version

26.6

### Installation Method

Swift Package Manager

### Firebase Product(s)

App Distribution, Analytics, Crashlytics

### Targeted Platforms

iOS

### Relevant Log Output

```shell

```

### If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

```json

Replace this line with the contents of your Package.resolved.

```

### If using CocoaPods, the project's Podfile.lock

_No response_

Start by examining the Release app binary and the Firebase iOS SDK's Swift Package Manager dependency graph for libz.1.dylib, then compare that provenance with the Xcode 26.6 toolchain. Confirm whether Firebase introduces the library, identify any documented mitigation, and record official guidance for an AppSec exception if the finding is not actionable.

Written by the indexing model from the issue text.