Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@strapi/strapi

11 known vulnerabilities (1 critical, 4 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
5.61.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release
5.61.0 (Nov 4, 2026), the latest release
Advisories
11 · 1 critical, 4 high, 2 medium
Weekly downloads
336.9K
Dependents
16
Releases
500+ since 5.48.0 (Jun 10, 2026)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-27886
    No published release is affected
    No published release is affected
  • CVE-2025-3930
    Affects 0.0.0-experimental.0008b7f1c9e3678ad260dac74a24f2d9f8d8a5c7 to 0.0.0-next.fd8661800b5e6f888e7cf6ef40e3e14d9d0b9cbf (5.48.0 is outside it)
  • CVE-2024-37818
    No published release is affected
    No published release is affected
  • CVE-2023-39345
    No published release is affected
    No published release is affected
  • CVE-2023-34093
    Affects 0.0.0-experimental.0008b7f1c9e3678ad260dac74a24f2d9f8d8a5c7 to 0.0.0-next.fd8661800b5e6f888e7cf6ef40e3e14d9d0b9cbf (5.48.0 is outside it)
  • CVE-2023-22894
    No published release is affected
    No published release is affected
  • CVE-2022-31367
    No published release is affected
    No published release is affected
  • CVE-2022-32114
    Affects 0.0.0-experimental.0008b7f1c9e3678ad260dac74a24f2d9f8d8a5c7 to 0.0.0-next.fd8661800b5e6f888e7cf6ef40e3e14d9d0b9cbf (5.48.0 is outside it)
  • CVE-2022-30618
    Affects 0.0.0-experimental.0008b7f1c9e3678ad260dac74a24f2d9f8d8a5c7 to 0.0.0-next.fd8661800b5e6f888e7cf6ef40e3e14d9d0b9cbf (5.48.0 is outside it)
  • CVE-2022-30617
    Affects 0.0.0-experimental.0008b7f1c9e3678ad260dac74a24f2d9f8d8a5c7 to 0.0.0-next.fd8661800b5e6f888e7cf6ef40e3e14d9d0b9cbf (5.48.0 is outside it)
  • CVE-2021-46440
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 11

  • CVE-2026-27886Critical 9.2

    Strapi may leak sensitive data via relational filtering due to lack of query sanitization

    Affected: from 4.0.0, fixed in 5.37.0.

    Fixed in 5.48.0 (released Jun 10, 2026, 27 days after disclosure, the advisory names 5.37.0, which was never published).

    The latest release, 5.61.0, is not affected.

    40% of @strapi/strapi downloads last week were affected versions (126.7K).

  • CVE-2025-3930Medium 6.3

    Lack of JWT Expiration after Log Out in Strapi

    Affected: fixed in 5.24.1.

    Fixed in 5.48.0 (released Jun 10, 2026, 237 days after disclosure, the advisory names 5.24.1, which was never published).

    The latest release, 5.61.0, is not affected.

    36% of @strapi/strapi downloads last week were affected versions (114.6K).

  • Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.

    Affected: versions 4.24.4.

    Fixed in 5.48.0 (released Jun 10, 2026, 720 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 5.61.0, is not affected.

    <0.1% of @strapi/strapi downloads last week were affected versions (214).

  • Unauthorized Access to Private Fields in User Registration API in strapi

    Affected: from 4.0.0, fixed in 4.13.1.

    Fixed in 5.48.0 (released Jun 10, 2026, 947 days after disclosure, the advisory names 4.13.1, which was never published).

    The latest release, 5.61.0, is not affected.

    4.5% of @strapi/strapi downloads last week were affected versions (14.3K).

  • CVE-2023-34093Medium 4.8

    Strapi allows actors to make all attributes on a content-type public without noticing it

    Affected: fixed in 4.10.8.

    Fixed in 5.48.0 (released Jun 10, 2026, 1051 days after disclosure, the advisory names 4.10.8, which was never published).

    The latest release, 5.61.0, is not affected.

    8.3% of @strapi/strapi downloads last week were affected versions (26.5K).

  • CVE-2023-22894High 7.2 · KEV

    Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter.

    Affected: from 3.2.1, fixed in 4.8.0.

    Fixed in 5.48.0 (released Jun 10, 2026, 1148 days after disclosure, the advisory names 4.8.0, which was never published).

    The latest release, 5.61.0, is not affected.

    3.1% of @strapi/strapi downloads last week were affected versions (9.9K).

  • Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.

    Affected: from 4.0.0-next.0, fixed in 4.1.10.

    Fixed in 5.48.0 (released Jun 10, 2026, 1352 days after disclosure, the advisory names 4.1.10, which was never published).

    The latest release, 5.61.0, is not affected.

    0.4% of @strapi/strapi downloads last week were affected versions (1.2K).

  • An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a…

    Affected: through 4.1.12.

    Fixed in 5.48.0 (released Jun 10, 2026, 1428 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 5.61.0, is not affected.

    5.1% of @strapi/strapi downloads last week were affected versions (16.3K).

  • An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens…

    Affected: fixed in 4.1.9.

    Fixed in 5.48.0 (released Jun 10, 2026, 1483 days after disclosure, the advisory names 4.1.9, which was never published).

    The latest release, 5.61.0, is not affected.

    5% of @strapi/strapi downloads last week were affected versions (16.2K).

  • An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens…

    Affected: fixed in 4.0.0-beta.15.

    Fixed in 5.48.0 (released Jun 10, 2026, 1483 days after disclosure, the advisory names 4.0.0-beta.15, which was never published).

    The latest release, 5.61.0, is not affected.

    4.7% of @strapi/strapi downloads last week were affected versions (15.1K).

  • Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an…

    Affected: from 4.0.0, fixed in 4.1.5.

    Fixed in 5.48.0 (released Jun 10, 2026, 1499 days after disclosure, the advisory names 4.1.5, which was never published).

    The latest release, 5.61.0, is not affected.

    0.3% of @strapi/strapi downloads last week were affected versions (958).