Vulnerabilities reported on a fresh CRA install

[kidrecursive]

Heya, when trying out npx sb init on a brand new create-react-app (npx create-react-app my-app) NPM is reporting:

29 vulnerabilities (21 moderate, 8 high)

When running npm audit fix, the vulnerabilities remain, is this expected behavior on a fresh setup? (Versions listed below)

NodeJS - v14.17.4
NPM - 7.20.5
@storybook - 6.3.6
@storybook/preset-create-react-app - 3.2.0