Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@sigstore/oci

2 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
0.8.0 (Nov 5, 2026): no advisory affects it
Newest unaffected release
0.8.0 (Nov 5, 2026), the latest release
Advisories
2 · 1 critical, 1 high
Weekly downloads
15.7K
Dependents
1
Releases
18 since 0.1.0 (Feb 9, 2024)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

    Affected: fixed in 0.7.2.

    Fixed in 0.7.2 (released Aug 4, 2026, 86 days before disclosure).

    The latest release, 0.8.0, is not affected.

    14% of @sigstore/oci downloads last week were affected versions (1.9K).

  • CVE-2026-59891Critical 9.6

    Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

    Affected: fixed in 0.7.1.

    Fixed in 0.7.1 (released Jun 25, 2026, 19 days before disclosure).

    The latest release, 0.8.0, is not affected.

    10% of @sigstore/oci downloads last week were affected versions (1.3K).