- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 5 · 1 critical, 3 high, 1 medium
- Registry
- pkg.go.dev
Advisories 5
- CVE-2026-50018Medium 6.5
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
Affected: fixed in 1.12.8.
- CVE-2026-50013High 7.5
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
Affected: fixed in 1.12.8.
- CVE-2025-54376High 7.8
Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.
Affected: fixed in 1.12.0.
- CVE-2025-54123Critical 9.8
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
Affected: through 1.11.3; all versions.
- CVE-2024-45388High 7.5
Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)
Affected: fixed in 1.10.3; fixed in 1.10.3.