# github.com/centrifugal/centrifugo/v4 (Go) vulnerabilities 3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v4.1.5 (Jun 24, 2023): affected by 3 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 13 since v4.0.0 (Jul 20, 2022) - Registry: https://pkg.go.dev/github.com/centrifugal/centrifugo/v4 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-71485: v4.0.0-beta.1 to v4.1.5 (through the newest release) - CVE-2026-49998: v4.0.0-beta.1 to v4.1.5 (through the newest release) - CVE-2026-32301: v4.0.0-beta.1 to v4.1.5 (through the newest release) ## Advisories (3) ### [CVE-2026-71485](https://cve.now/CVE-2026-71485): Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends - Severity: Critical 9.1 - Published: Aug 20, 2026 - Affected: all versions. - No fix released. The latest release, v4.1.5, is still affected. ### [CVE-2026-49998](https://cve.now/CVE-2026-49998): Centrifugo: Dynamic JWKS key cache keyed only by \`kid\` allows cross-issuer JWT authentication bypass - Severity: High 8.2 - Published: Jul 16, 2026 - Affected: all versions; through 4.1.5. - No fix released. The latest release, v4.1.5, is still affected. ### [CVE-2026-32301](https://cve.now/CVE-2026-32301): Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL - Severity: Critical 9.3 - Published: Mar 12, 2026 - Affected: through 4.1.5; all versions. - No fix released. The latest release, v4.1.5, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/centrifugal/centrifugo/v4 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.