GoPackage

github.com/centrifugal/centrifugo/v5

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release: v5.4.9 (Dec 22, 2024): affected by 3 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 2 critical, 1 high

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-71485Critical 9.1
Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
Affected: all versions.
No fix released. The latest release, v5.4.9, is still affected.
CVE-2026-49998High 8.2
Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass
Affected: all versions; through 5.4.9.
No fix released. The latest release, v5.4.9, is still affected.
CVE-2026-32301Critical 9.3
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
Affected: through 5.4.9; all versions.
No fix released. The latest release, v5.4.9, is still affected.