Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@sync-in/server

7 known vulnerabilities (2 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 high, 5 medium
Weekly downloads
498
Dependents
0
Registry
npm

Advisories 7

  • CVE-2026-58272Medium 5.3

    Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack…

    Affected: fixed in 2.4.1.

  • CVE-2026-58270Medium 6.5

    Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

    Affected: fixed in 2.4.0.

  • Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

    Affected: fixed in 2.4.0.

  • CVE-2026-58271Medium 6.8

    @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

    Affected: fixed in 2.4.0.

  • Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP

    Affected: fixed in 2.3.0.

  • CVE-2026-41161Medium 6.9

    Username Enumeration via Timing Attack

    Affected: fixed in 2.2.0.

  • CVE-2025-67438Medium 6.1

    A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary…

    Affected: fixed in 1.9.3.