# handlebars (npm) vulnerabilities 15 known vulnerabilities (3 critical, 4 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.7.10 (Oct 5, 2026): no advisory affects it - Newest unaffected release: 4.7.10 (Oct 5, 2026), the latest release - Weekly downloads: 57.9M - Dependents: 57.1K - Releases: 82 since 1.0.6 (Jul 23, 2012) - Registry: https://www.npmjs.com/package/handlebars - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-106446: 4.0.0 to 4.7.9 (4.7.10 is outside it) - CVE-2026-106445: 3.0.0 to 4.7.9 (4.7.10 is outside it) - CVE-2026-106444: 4.0.0 to 4.7.9 (4.7.10 is outside it) - CVE-2026-33941: 4.0.0 to 4.7.8 (4.7.9 is outside it) - CVE-2026-33940: 4.0.0 to 4.7.8 (4.7.9 is outside it) - CVE-2026-33939: 4.0.0 to 4.7.8 (4.7.9 is outside it) - CVE-2026-33938: 4.0.0 to 4.7.8 (4.7.9 is outside it) - CVE-2026-33937: 4.0.0 to 4.7.8 (4.7.9 is outside it) - CVE-2026-33916: 4.0.0 to 4.7.8 (4.7.9 is outside it) - CVE-2021-23383: 1.0.2-beta to 4.7.6 (4.7.7 is outside it) - CVE-2021-23369: 1.0.2-beta to 4.7.6 (4.7.7 is outside it) - CVE-2019-20920: 1.0.2-beta to 3.0.7 (3.0.8 is outside it); 4.0.0 to 4.5.2 (4.5.3 is outside it) - CVE-2019-20922: 4.0.0 to 4.4.4 (4.4.5 is outside it) - CVE-2019-19919: 1.0.2-beta to 3.0.7 (3.0.8 is outside it); 4.0.0 to 4.2.2 (4.3.0 is outside it) - CVE-2015-8861: 1.0.2-beta to 3.0.8 (4.0.0 is outside it) ## Advisories (15) ### [CVE-2026-106446](https://cve.now/CVE-2026-106446): Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) - Severity: Critical 9.8 - Published: Oct 6, 2026 - Affected: from 4.0.0, fixed in 4.7.10. - Fixed in 4.7.10 (released Oct 5, 2026, 1 day before disclosure). - The latest release, 4.7.10, is not affected. - 61% of handlebars downloads last week were affected versions (39M). ### [CVE-2026-106445](https://cve.now/CVE-2026-106445): Handlebars: JavaScript Injection via Own Property Check Bypass - Severity: Critical 9.2 - Published: Oct 6, 2026 - Affected: from 3.0.0, fixed in 4.7.10. - Fixed in 4.7.10 (released Oct 5, 2026, 1 day before disclosure). - The latest release, 4.7.10, is not affected. - 61% of handlebars downloads last week were affected versions (39.1M). ### [CVE-2026-106444](https://cve.now/CVE-2026-106444): Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates - Severity: Medium 4.7 - Published: Oct 6, 2026 - Affected: from 4.0.0, fixed in 4.7.10. - Fixed in 4.7.10 (released Oct 5, 2026, 1 day before disclosure). - The latest release, 4.7.10, is not affected. - 61% of handlebars downloads last week were affected versions (39M). ### [CVE-2026-33941](https://cve.now/CVE-2026-33941): Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options - Severity: High 8.3 - Published: Mar 27, 2026 - Affected: from 4.0.0, fixed in 4.7.9. - Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure). - The latest release, 4.7.10, is not affected. - 34% of handlebars downloads last week were affected versions (21.7M). ### [CVE-2026-33940](https://cve.now/CVE-2026-33940): Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial - Severity: High 8.1 - Published: Mar 27, 2026 - Affected: from 4.0.0, fixed in 4.7.9. - Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure). - The latest release, 4.7.10, is not affected. - 34% of handlebars downloads last week were affected versions (21.7M). ### [CVE-2026-33939](https://cve.now/CVE-2026-33939): Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation - Severity: High 7.5 - Published: Mar 27, 2026 - Affected: from 4.0.0, fixed in 4.7.9. - Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure). - The latest release, 4.7.10, is not affected. - 34% of handlebars downloads last week were affected versions (21.7M). ### [CVE-2026-33938](https://cve.now/CVE-2026-33938): Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block - Severity: High 8.1 - Published: Mar 27, 2026 - Affected: from 4.0.0, fixed in 4.7.9. - Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure). - The latest release, 4.7.10, is not affected. - 34% of handlebars downloads last week were affected versions (21.7M). ### [CVE-2026-33937](https://cve.now/CVE-2026-33937): Handlebars.js has JavaScript Injection via AST Type Confusion - Severity: Critical 9.8 - Published: Mar 27, 2026 - Affected: from 4.0.0, fixed in 4.7.9. - Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure). - The latest release, 4.7.10, is not affected. - 34% of handlebars downloads last week were affected versions (21.7M). ### [CVE-2026-33916](https://cve.now/CVE-2026-33916): Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection - Severity: Medium 4.7 - Published: Mar 27, 2026 - Affected: from 4.0.0, fixed in 4.7.9. - Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure). - The latest release, 4.7.10, is not affected. - 34% of handlebars downloads last week were affected versions (21.7M). ### [CVE-2021-23383](https://cve.now/CVE-2021-23383): Prototype Pollution - Severity: Medium 5.6 - Published: May 4, 2021 - Affected: fixed in 4.7.7. - Fixed in 4.7.7 (released Feb 15, 2021, 78 days before disclosure). - The latest release, 4.7.10, is not affected. - 3% of handlebars downloads last week were affected versions (1.9M). ### [CVE-2021-23369](https://cve.now/CVE-2021-23369): Remote Code Execution (RCE) - Severity: Medium 5.6 - Published: Apr 12, 2021 - Affected: fixed in 4.7.7. - Fixed in 4.7.7 (released Feb 15, 2021, 56 days before disclosure). - The latest release, 4.7.10, is not affected. - 3% of handlebars downloads last week were affected versions (1.9M). ### [CVE-2019-20920](https://cve.now/CVE-2019-20920): Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. - Severity: Unrated - Published: Sep 30, 2020 - Affected: fixed in 3.0.8; from 4.0.0, fixed in 4.5.3. - Fixed in 3.0.8 (released Feb 23, 2020, 220 days before disclosure) and 4.5.3 (released Nov 18, 2019, 317 days before disclosure). - The latest release, 4.7.10, is not affected. - 1.9% of handlebars downloads last week were affected versions (1.2M). ### [CVE-2019-20922](https://cve.now/CVE-2019-20922): Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. - Severity: Unrated - Published: Sep 30, 2020 - Affected: from 4.0.0, fixed in 4.4.5. - Fixed in 4.4.5 (released Oct 20, 2019, 346 days before disclosure). - The latest release, 4.7.10, is not affected. - 1.4% of handlebars downloads last week were affected versions (924.5K). ### [CVE-2019-19919](https://cve.now/CVE-2019-19919): Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. - Severity: Unrated - Published: Dec 20, 2019 - Affected: from 4.0.0, fixed in 4.3.0; fixed in 3.0.8. - Fixed in 3.0.8 (released Feb 23, 2020, 65 days after disclosure) and 4.3.0 (released Sep 24, 2019, 87 days before disclosure). - The latest release, 4.7.10, is not affected. - 1.8% of handlebars downloads last week were affected versions (1.1M). ### [CVE-2015-8861](https://cve.now/CVE-2015-8861): The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a… - Severity: Unrated - Published: Jan 23, 2017 - Affected: fixed in 4.0.0. - Fixed in 4.0.0 (released Sep 1, 2015, 510 days before disclosure). - The latest release, 4.7.10, is not affected. - 0.5% of handlebars downloads last week were affected versions (313.3K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/handlebars Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.