# @strapi/strapi (npm) vulnerabilities 11 known vulnerabilities (1 critical, 4 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.61.0 (Nov 4, 2026): no advisory affects it - Newest unaffected release: 5.61.0 (Nov 4, 2026), the latest release - Weekly downloads: 336.9K - Dependents: 16 - Releases: 500+ since 5.48.0 (Jun 10, 2026) - Registry: https://www.npmjs.com/package/@strapi/strapi - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-27886: no published release is affected - CVE-2025-3930: 0.0.0-experimental.0008b7f1c9e3678ad260dac74a24f2d9f8d8a5c7 to 0.0.0-next.fd8661800b5e6f888e7cf6ef40e3e14d9d0b9cbf (5.48.0 is outside it) - CVE-2024-37818: no published release is affected - CVE-2023-39345: no published release is affected - CVE-2023-34093: 0.0.0-experimental.0008b7f1c9e3678ad260dac74a24f2d9f8d8a5c7 to 0.0.0-next.fd8661800b5e6f888e7cf6ef40e3e14d9d0b9cbf (5.48.0 is outside it) - CVE-2023-22894: no published release is affected - CVE-2022-31367: no published release is affected - CVE-2022-32114: 0.0.0-experimental.0008b7f1c9e3678ad260dac74a24f2d9f8d8a5c7 to 0.0.0-next.fd8661800b5e6f888e7cf6ef40e3e14d9d0b9cbf (5.48.0 is outside it) - CVE-2022-30618: 0.0.0-experimental.0008b7f1c9e3678ad260dac74a24f2d9f8d8a5c7 to 0.0.0-next.fd8661800b5e6f888e7cf6ef40e3e14d9d0b9cbf (5.48.0 is outside it) - CVE-2022-30617: 0.0.0-experimental.0008b7f1c9e3678ad260dac74a24f2d9f8d8a5c7 to 0.0.0-next.fd8661800b5e6f888e7cf6ef40e3e14d9d0b9cbf (5.48.0 is outside it) - CVE-2021-46440: no published release is affected Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (11) ### [CVE-2026-27886](https://cve.now/CVE-2026-27886): Strapi may leak sensitive data via relational filtering due to lack of query sanitization - Severity: Critical 9.2 - Published: May 14, 2026 - Affected: from 4.0.0, fixed in 5.37.0. - Fixed in 5.48.0 (released Jun 10, 2026, 27 days after disclosure, the advisory names 5.37.0, which was never published). - The latest release, 5.61.0, is not affected. - 40% of @strapi/strapi downloads last week were affected versions (126.7K). ### [CVE-2025-3930](https://cve.now/CVE-2025-3930): Lack of JWT Expiration after Log Out in Strapi - Severity: Medium 6.3 - Published: Oct 16, 2025 - Affected: fixed in 5.24.1. - Fixed in 5.48.0 (released Jun 10, 2026, 237 days after disclosure, the advisory names 5.24.1, which was never published). - The latest release, 5.61.0, is not affected. - 36% of @strapi/strapi downloads last week were affected versions (114.6K). ### [CVE-2024-37818](https://cve.now/CVE-2024-37818): Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/\_next/image. - Severity: High 8.6 - Published: Jun 20, 2024 - Affected: versions 4.24.4. - Fixed in 5.48.0 (released Jun 10, 2026, 720 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 5.61.0, is not affected. - <0.1% of @strapi/strapi downloads last week were affected versions (214). ### [CVE-2023-39345](https://cve.now/CVE-2023-39345): Unauthorized Access to Private Fields in User Registration API in strapi - Severity: High 7.6 - Published: Nov 6, 2023 - Affected: from 4.0.0, fixed in 4.13.1. - Fixed in 5.48.0 (released Jun 10, 2026, 947 days after disclosure, the advisory names 4.13.1, which was never published). - The latest release, 5.61.0, is not affected. - 4.5% of @strapi/strapi downloads last week were affected versions (14.3K). ### [CVE-2023-34093](https://cve.now/CVE-2023-34093): Strapi allows actors to make all attributes on a content-type public without noticing it - Severity: Medium 4.8 - Published: Jul 25, 2023 - Affected: fixed in 4.10.8. - Fixed in 5.48.0 (released Jun 10, 2026, 1051 days after disclosure, the advisory names 4.10.8, which was never published). - The latest release, 5.61.0, is not affected. - 8.3% of @strapi/strapi downloads last week were affected versions (26.5K). ### [CVE-2023-22894](https://cve.now/CVE-2023-22894): Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. - Severity: High 7.2 · KEV - Published: Apr 19, 2023 - Affected: from 3.2.1, fixed in 4.8.0. - Fixed in 5.48.0 (released Jun 10, 2026, 1148 days after disclosure, the advisory names 4.8.0, which was never published). - The latest release, 5.61.0, is not affected. - 3.1% of @strapi/strapi downloads last week were affected versions (9.9K). ### [CVE-2022-31367](https://cve.now/CVE-2022-31367): Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses. - Severity: High 8.8 - Published: Sep 27, 2022 - Affected: from 4.0.0-next.0, fixed in 4.1.10. - Fixed in 5.48.0 (released Jun 10, 2026, 1352 days after disclosure, the advisory names 4.1.10, which was never published). - The latest release, 5.61.0, is not affected. - 0.4% of @strapi/strapi downloads last week were affected versions (1.2K). ### [CVE-2022-32114](https://cve.now/CVE-2022-32114): An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a… - Severity: Unrated - Published: Jul 13, 2022 - Affected: through 4.1.12. - Fixed in 5.48.0 (released Jun 10, 2026, 1428 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 5.61.0, is not affected. - 5.1% of @strapi/strapi downloads last week were affected versions (16.3K). ### [CVE-2022-30618](https://cve.now/CVE-2022-30618): An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens… - Severity: Unrated - Published: May 19, 2022 - Affected: fixed in 4.1.9. - Fixed in 5.48.0 (released Jun 10, 2026, 1483 days after disclosure, the advisory names 4.1.9, which was never published). - The latest release, 5.61.0, is not affected. - 5% of @strapi/strapi downloads last week were affected versions (16.2K). ### [CVE-2022-30617](https://cve.now/CVE-2022-30617): An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens… - Severity: Unrated - Published: May 19, 2022 - Affected: fixed in 4.0.0-beta.15. - Fixed in 5.48.0 (released Jun 10, 2026, 1483 days after disclosure, the advisory names 4.0.0-beta.15, which was never published). - The latest release, 5.61.0, is not affected. - 4.7% of @strapi/strapi downloads last week were affected versions (15.1K). ### [CVE-2021-46440](https://cve.now/CVE-2021-46440): Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an… - Severity: Unrated - Published: May 3, 2022 - Affected: from 4.0.0, fixed in 4.1.5. - Fixed in 5.48.0 (released Jun 10, 2026, 1499 days after disclosure, the advisory names 4.1.5, which was never published). - The latest release, 5.61.0, is not affected. - 0.3% of @strapi/strapi downloads last week were affected versions (958). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@strapi/strapi Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.