Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@budibase/backend-core

6 known vulnerabilities (2 critical, 2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
3.50.0 (Oct 19, 2026): no advisory affects it
Newest unaffected release
3.50.0 (Oct 19, 2026), the latest release
Advisories
6 · 2 critical, 2 high, 2 medium
Weekly downloads
9,760
Dependents
6
Releases
500+ since 2.23.2 (Apr 11, 2024)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 6

  • Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation

    Affected: fixed in 3.39.9.

    Fixed in 3.39.15 (released Jun 15, 2026, 11 days before disclosure, the advisory names 3.39.9, which was never published).

    The latest release, 3.50.0, is not affected.

    93% of @budibase/backend-core downloads last week were affected versions (5.5K).

  • CVE-2026-48147Medium 6.5

    Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker

    Affected: fixed in 3.35.4.

    Fixed in 3.35.10 (released Apr 21, 2026, 36 days before disclosure, the advisory names 3.35.4, which was never published).

    The latest release, 3.50.0, is not affected.

    92% of @budibase/backend-core downloads last week were affected versions (5.5K).

  • CVE-2026-46424Medium 4.2

    Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour

    Affected: fixed in 3.38.2.

    Fixed in 3.38.2 (released May 13, 2026, 14 days before disclosure).

    The latest release, 3.50.0, is not affected.

    93% of @budibase/backend-core downloads last week were affected versions (5.5K).

  • Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

    Affected: fixed in 3.35.10.

    Fixed in 3.35.10 (released Apr 21, 2026, 16 days before disclosure).

    The latest release, 3.50.0, is not affected.

    92% of @budibase/backend-core downloads last week were affected versions (5.5K).

  • CVE-2026-41428Critical 9.1

    Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

    Affected: through 3.35.3.

    Fixed in 3.35.10 (released Apr 21, 2026, 3 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.50.0, is not affected.

    92% of @budibase/backend-core downloads last week were affected versions (5.5K).

  • CVE-2026-31818Critical 9.6

    Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

    Affected: fixed in 3.33.4.

    Fixed in 3.33.4 (released Mar 13, 2026, 21 days before disclosure).

    The latest release, 3.50.0, is not affected.

    91% of @budibase/backend-core downloads last week were affected versions (5.4K).