Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/fatedier/frp

2 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
v0.72.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release
v0.72.0 (Nov 4, 2026), the latest release
Advisories
2 · 1 high, 1 medium
Releases
119 since v0.1.0 (Feb 28, 2016)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

    Affected: from 0.53.0, fixed in 0.70.1.

    Fixed in v0.70.1 (released Jul 23, 2026, 21 days before disclosure).

    The latest release, v0.72.0, is not affected.

  • CVE-2026-40910Medium 6.5

    frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control

    Affected: from 0.43.0, fixed in 0.68.1.

    Fixed in v0.68.1 (released Apr 13, 2026, 8 days before disclosure).

    The latest release, v0.72.0, is not affected.