# nodebb (npm) vulnerabilities

14 known vulnerabilities (5 critical, 2 high, 5 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.npmjs.com/package/nodebb

## Advisories (14)

### [CVE-2025-50979](https://cve.now/CVE-2025-50979): NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories).

- Severity: High 8.6
- Published: Aug 27, 2025
- Affected: through 4.3.0.

### [CVE-2024-57041](https://cve.now/CVE-2024-57041): A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me'…

- Severity: Medium 4.6
- Published: Jan 24, 2025
- Affected: fixed in 3.11.1.

### [CVE-2024-29316](https://cve.now/CVE-2024-29316): NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group…

- Severity: Medium 6.3
- Published: Mar 28, 2024
- Affected: fixed in 3.6.7.

### [CVE-2023-2850](https://cve.now/CVE-2023-2850): NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin.

- Severity: Medium 4.7
- Published: Jul 25, 2023
- Affected: from 3.0.0, fixed in 3.1.3; fixed in 2.8.13.

### [CVE-2023-26045](https://cve.now/CVE-2023-26045): NodeBB vulnerable to path traversal and code execution via prototype vulnerability

- Severity: Critical 10.0
- Published: Jul 24, 2023
- Affected: from 2.5.0, fixed in 2.8.7.

### [CVE-2022-46164](https://cve.now/CVE-2022-46164): Account takeover via prototype vulnerability

- Severity: Critical 9.4
- Published: Dec 5, 2022
- Affected: fixed in 2.6.1.

### [CVE-2022-3978](https://cve.now/CVE-2022-3978): NodeBB abort cross-site request forgery

- Severity: Medium 4.3
- Published: Nov 13, 2022
- Affected: fixed in 2.5.8.

### [CVE-2022-36076](https://cve.now/CVE-2022-36076): Account takeover via SSO plugins in NodeBB

- Severity: High 8.8
- Published: Sep 2, 2022
- Affected: fixed in 1.17.2.

### [CVE-2022-36045](https://cve.now/CVE-2022-36045): Account takeover via cryptographically weak PRNG in NodeBB Forum

- Severity: Critical 9.0
- Published: Aug 31, 2022
- Affected: fixed in 1.19.8; from 2.0.0, fixed in 2.0.1.

### [CVE-2021-43788](https://cve.now/CVE-2021-43788): Path traversal in translator module of NobeBB

- Severity: Medium 5.0
- Published: Nov 29, 2021
- Affected: from 1.0.4, fixed in 1.18.5.

### [CVE-2021-43786](https://cve.now/CVE-2021-43786): API token verification can be bypassed

- Severity: Critical 9.8
- Published: Nov 29, 2021
- Affected: from 1.15.0, fixed in 1.18.5.

### [CVE-2021-43787](https://cve.now/CVE-2021-43787): XSS via prototype pollution

- Severity: Critical 9.0
- Published: Nov 29, 2021
- Affected: from 1.15.0, fixed in 1.18.5.

### [CVE-2015-9286](https://cve.now/CVE-2015-9286): Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.

- Severity: Unrated
- Published: Apr 30, 2019
- Affected: fixed in 0.8.2.

### [CVE-2015-3296](https://cve.now/CVE-2015-3296): Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via…

- Severity: Unrated
- Published: Sep 21, 2017
- Affected: fixed in 0.70.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/nodebb
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.