Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@haxtheweb/open-apis

2 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
26.0.7 (Jul 30, 2026): no advisory affects it
Newest unaffected release
26.0.7 (Jul 30, 2026), the latest release
Advisories
2 · 1 high, 1 medium
Weekly downloads
270
Dependents
1
Releases
14 since 9.0.9 (Oct 30, 2024)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

    Affected: fixed in 26.0.0.

    Fixed in 26.0.0 (released May 12, 2026, 24 days before disclosure).

    The latest release, 26.0.7, is not affected.

    61% of @haxtheweb/open-apis downloads last week were affected versions (94).

  • CVE-2025-48996Medium 5.3

    Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint

    Affected: through 10.0.1.

    Fixed in 11.0.2 (released Jun 6, 2025, 4 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 26.0.7, is not affected.

    31% of @haxtheweb/open-apis downloads last week were affected versions (48).