GoPackage

github.com/QuantumNous/new-api

14 known vulnerabilities (2 critical, 7 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release: v0.13.2 (Apr 27, 2026): affected by 8 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 14 · 2 critical, 7 high, 5 medium

Releases: 203 since v0.9.7 (Oct 12, 2025)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-64865
Affects v0.9.7-patch.1 to v1.0.0-rc.15 (v1.0.0-rc.16 is outside it)
CVE-2026-71479
Affects v0.9.7-patch.1 to v1.0.0-rc.17 (v1.0.0-rc.18 is outside it)
CVE-2026-64866
Affects v0.9.7-patch.1 to v1.0.0-rc.6 (v1.0.0-rc.7 is outside it)
CVE-2026-64868
Affects v0.9.7-patch.1 to v1.0.0-rc.10 (v1.0.0-rc.11 is outside it)
CVE-2026-64859
Affects v0.9.7-patch.1 to v1.0.0-rc.6 (v1.0.0-rc.7 is outside it)
CVE-2026-44342
Affects v0.9.7-patch.1 to v0.11.9 (v0.12.0-alpha.1 is outside it)
CVE-2026-33655
Affects v0.9.7-patch.1 to v0.11.9 (v0.12.0-alpha.1 is outside it)
CVE-2026-42339
Affects v0.9.7-patch.1 to v1.0.0-rc.49 (through the newest release)
CVE-2026-41432
Affects v0.9.7-patch.1 to v0.12.9 (v0.12.10 is outside it)
CVE-2026-32879
Affects v0.10.0 to v1.0.0-rc.49 (through the newest release)
CVE-2026-30886
Affects v0.9.7-patch.1 to v0.11.4-alpha.1 (v0.11.4-alpha.2 is outside it)
CVE-2026-25802
Affects v0.9.7-patch.1 to v0.10.8-alpha.8 (v0.10.8-alpha.9 is outside it)

Show all 14 advisoriesShow fewer advisories

CVE-2026-25591
Affects v0.9.7-patch.1 to v0.10.8-alpha.9 (v0.10.8-alpha.10 is outside it)
CVE-2025-62155
Affects v0.9.7-patch.1 to v1.0.0-rc.49 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 14

CVE-2026-64865Medium 6.0
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass
Affected: fixed in 1.0.0-rc.16.
Fixed in v1.0.0-rc.16 (released Jul 3, 2026, 45 days before disclosure).
The latest release, v0.13.2, is still affected.
CVE-2026-71479Critical 9.1
New API: Integer overflow in quota billing yields negative charges (self-crediting)
Affected: fixed in 1.0.0-rc.18.
Fixed in v1.0.0-rc.18 (released Jul 6, 2026, 42 days before disclosure).
The latest release, v0.13.2, is still affected.
CVE-2026-64866Medium 5.1
New API: Admin can reset passkeys for same-level or higher-privileged users
Affected: from 0.9.1.3, fixed in 1.0.0-rc.7; fixed in 1.0.0-rc.7.
Fixed in v1.0.0-rc.7 (released May 19, 2026, 90 days before disclosure).
The latest release, v0.13.2, is still affected.
CVE-2026-64868High 7.5
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging
Affected: fixed in 1.0.0-rc.11.
Fixed in v1.0.0-rc.11 (released Jun 13, 2026, 65 days before disclosure).
The latest release, v0.13.2, is still affected.
CVE-2026-64859Critical 9.1
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
Affected: fixed in 1.0.0-rc.7.
Fixed in v1.0.0-rc.7 (released May 19, 2026, 90 days before disclosure).
The latest release, v0.13.2, is still affected.
CVE-2026-44342Medium 5.3
New API CSRF in email and WeChat account binding endpoints
Affected: fixed in 0.12.0-alpha.1.
Fixed in v0.12.0-alpha.1 (released Mar 31, 2026, 100 days before disclosure).
The latest release, v0.13.2, is not affected.
CVE-2026-33655High 7.7
New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
Affected: fixed in 0.12.0-alpha.1.
Fixed in v0.12.0-alpha.1 (released Mar 31, 2026, 100 days before disclosure).
The latest release, v0.13.2, is not affected.
CVE-2026-42339High 7.1
New API: SSRF Filter Bypass via 0.0.0.0
Affected: through 0.11.9-alpha.1; all versions.
No fix released. The latest release, v0.13.2, is still affected.
CVE-2026-41432High 7.1
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
Affected: fixed in 0.12.10.
Fixed in v0.12.10 (released Apr 15, 2026, 23 days before disclosure).
The latest release, v0.13.2, is not affected.
CVE-2026-32879Medium 4.9
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure
Affected: from 0.10.0, through 0.11.9-alpha.1; from 0.10.0.
No fix released. The latest release, v0.13.2, is still affected.
CVE-2026-30886Medium 6.5
New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check
Affected: fixed in 0.11.4-alpha.2.
Fixed in v0.11.4-alpha.2 (released Mar 6, 2026, 17 days before disclosure).
The latest release, v0.13.2, is not affected.
CVE-2026-25802High 7.6
New API has Potential XSS in its MarkdownRenderer component
Affected: fixed in 0.10.8-alpha.9.
Fixed in v0.10.8-alpha.9 (released Feb 6, 2026, 18 days before disclosure).
The latest release, v0.13.2, is not affected.
CVE-2026-25591High 7.1
New API has an SQL LIKE Wildcard Injection DoS via Token Search
Affected: fixed in 0.10.8-alpha.10.
Fixed in v0.10.8-alpha.10 (released Feb 6, 2026, 18 days before disclosure).
The latest release, v0.13.2, is not affected.
CVE-2025-62155High 8.5
QuantumNous New API Has SSRF Bypass
Affected: all versions; fixed in 0.9.6.
No fix released. The latest release, v0.13.2, is still affected.