npmPackage

@hulumi/policies

7 known vulnerabilities (3 critical, 4 high), with the versions each affects and the releases that fix them.

Latest release: 3.0.0 (Oct 14, 2026): no advisory affects it
Newest unaffected release: 3.0.0 (Oct 14, 2026), the latest release
Advisories: 7 · 3 critical, 4 high

Weekly downloads: 80
Dependents: 0
Releases: 16 since 1.2.0 (May 5, 2026)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-82861
Affects 1.2.0 to 1.3.1 (1.3.2 is outside it)
CVE-2026-82860
Affects 1.2.0 to 1.3.1 (1.3.2 is outside it)
CVE-2026-82856
Affects 1.2.0 to 1.3.1 (1.3.2 is outside it)
CVE-2026-82855
Affects 1.2.0 to 1.3.1 (1.3.2 is outside it)
CVE-2026-48033
Affects 1.2.0 to 1.3.2 (1.4.0 is outside it)
CVE-2026-48032
Affects 1.2.0 to 1.3.2 (1.4.0 is outside it)
CVE-2026-48034
Affects 1.2.0 to 1.3.2 (1.4.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

CVE-2026-82861High 8.7
@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass
Affected: fixed in 1.3.2.
Fixed in 1.3.2 (released May 15, 2026, 108 days before disclosure).
The latest release, 3.0.0, is not affected.
48% of @hulumi/policies downloads last week were affected versions (32).
CVE-2026-82860Critical 9.3
@hulumi/policies before 1.3.2 Admin Policy Bypass
Affected: fixed in 1.3.2.
Fixed in 1.3.2 (released May 15, 2026, 108 days before disclosure).
The latest release, 3.0.0, is not affected.
48% of @hulumi/policies downloads last week were affected versions (32).
CVE-2026-82856Critical 9.3
@hulumi/policies before 1.3.2 OIDC Trust Policy Bypass
Affected: fixed in 1.3.2.
Fixed in 1.3.2 (released May 15, 2026, 108 days before disclosure).
The latest release, 3.0.0, is not affected.
48% of @hulumi/policies downloads last week were affected versions (32).
CVE-2026-82855Critical 9.3
@hulumi/policies before 1.3.2 Evidence Validation Bypass
Affected: fixed in 1.3.2.
Fixed in 1.3.2 (released May 15, 2026, 108 days before disclosure).
The latest release, 3.0.0, is not affected.
48% of @hulumi/policies downloads last week were affected versions (32).
CVE-2026-48033High 8.4
Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name
Affected: fixed in 1.4.0.
Fixed in 1.4.0 (released May 20, 2026, 65 days before disclosure).
The latest release, 3.0.0, is not affected.
61% of @hulumi/policies downloads last week were affected versions (40).
CVE-2026-48032High 8.3
Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers
Affected: fixed in 1.4.0.
Fixed in 1.4.0 (released May 20, 2026, 65 days before disclosure).
The latest release, 3.0.0, is not affected.
61% of @hulumi/policies downloads last week were affected versions (40).
CVE-2026-48034High 8.5
HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
Affected: fixed in 1.4.0.
Fixed in 1.4.0 (released May 20, 2026, 65 days before disclosure).
The latest release, 3.0.0, is not affected.
61% of @hulumi/policies downloads last week were affected versions (40).