# github.com/free5gc/nrf (Go) vulnerabilities 3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.4.6 (Aug 21, 2026): no advisory affects it - Newest unaffected release: v1.4.6 (Aug 21, 2026), the latest release - Releases: 20 since v1.0.0 (Jan 30, 2021) - Registry: https://pkg.go.dev/github.com/free5gc/nrf - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-44325: v1.0.0 to v1.4.2 (v1.4.3 is outside it) - CVE-2026-33062: v1.0.0 to v1.4.1 (v1.4.2 is outside it) - CVE-2025-66719: v1.0.0 to v1.4.0 (v1.4.1 is outside it) ## Advisories (3) ### [CVE-2026-44325](https://cve.now/CVE-2026-44325): free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types) - Severity: High 7.5 - Published: May 27, 2026 - Affected: fixed in 1.4.3. - Fixed in v1.4.3 (released Apr 18, 2026, 39 days before disclosure). - The latest release, v1.4.6, is not affected. ### [CVE-2026-33062](https://cve.now/CVE-2026-33062): free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter - Severity: High 8.7 - Published: Mar 20, 2026 - Affected: fixed in 1.4.2. - Fixed in v1.4.2 (released Mar 2, 2026, 18 days before disclosure). - The latest release, v1.4.6, is not affected. ### [CVE-2025-66719](https://cve.now/CVE-2025-66719): An issue was discovered in Free5gc NRF 1.4.0. - Severity: Critical 9.1 - Published: Jan 23, 2026 - Affected: fixed in 1.4.1. - Fixed in v1.4.1 (released Jan 4, 2026, 19 days before disclosure). - The latest release, v1.4.6, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/free5gc/nrf Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.