- Latest release
- 23.4.0 (Oct 29, 2026): no advisory affects it
- Newest unaffected release
- 23.4.0 (Oct 29, 2026), the latest release
- Advisories
- 4 · 1 critical, 3 high
- Weekly downloads
- 68.1K
- Dependents
- 1
- Releases
- 240 since 2.6.1 (Jun 11, 2020)
- Registry
- npm
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-58230Affects 2.6.1 to 22.0.3 (23.0.0 is outside it)
- CVE-2026-44745Affects 2.6.1 to 21.1.0 (21.2.0 is outside it)
- CVE-2026-27690Affects 2.6.1 to 20.9.0 (20.10.0 is outside it)
- CVE-2025-24876Affects 2.6.1 to 16.7.1 (16.7.2 is outside it)
Advisories 4
- CVE-2026-58230High 7.0
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
Affected: fixed in 23.0.0.
Fixed in 23.0.0 (released Aug 11, 2026, the day of disclosure).
The latest release, 23.4.0, is not affected.
55% of @sap/approuter downloads last week were affected versions (46K).
- CVE-2026-44745High 8.1
Open Redirect vulnerability in SAP Approuter
Affected: fixed in 21.2.0.
Fixed in 21.2.0 (released Mar 28, 2026, 108 days before disclosure).
The latest release, 23.4.0, is not affected.
46% of @sap/approuter downloads last week were affected versions (38.1K).
- CVE-2026-27690Critical 9.1
HTTP Request Smuggling in SAP Approuter
Affected: fixed in 20.10.0.
Fixed in 20.10.0 (released Feb 19, 2026, 145 days before disclosure).
The latest release, 23.4.0, is not affected.
39% of @sap/approuter downloads last week were affected versions (32.5K).
- CVE-2025-24876High 8.1
Authentication bypass via authorization code injection in SAP Approuter
Affected: from 2.6.1, fixed in 16.7.2.
Fixed in 16.7.2 (released Sep 4, 2024, 160 days before disclosure).
The latest release, 23.4.0, is not affected.
12% of @sap/approuter downloads last week were affected versions (9.7K).