npmPackage

@mockoon/commons-server

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-59149Medium 6.5
Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
Affected: fixed in 9.7.0.
Fixed in 9.7.0 (released Jun 19, 2026, 20 days before disclosure).
The latest release, 9.10.0, is not affected.
39% of @mockoon/commons-server downloads last week were affected versions (36.7K).
CVE-2026-59148High 8.8
Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
Affected: fixed in 9.7.0.
Fixed in 9.7.0 (released Jun 19, 2026, 20 days before disclosure).
The latest release, 9.10.0, is not affected.
39% of @mockoon/commons-server downloads last week were affected versions (36.7K).
CVE-2025-59049High 7.5
Mockoon has a Path Traversal and LFI in the static file serving endpoint
Affected: fixed in 9.2.0.
Fixed in 9.2.0 (released Mar 12, 2025, 182 days before disclosure).
The latest release, 9.10.0, is not affected.
10% of @mockoon/commons-server downloads last week were affected versions (9.6K).