npmPackage

oneuptime

5 known vulnerabilities (1 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 4.0.69 (Jun 20, 2022): affected by 5 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 5 · 1 critical, 3 high, 1 medium

Weekly downloads: 455
Dependents: 0
Releases: 66 since 4.0.3 (Feb 5, 2022)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-33142
Affects 4.0.3 to 4.0.69 (through the newest release)
CVE-2026-33143
Affects 4.0.3 to 4.0.69 (through the newest release)
CVE-2026-32598
Affects 4.0.3 to 4.0.69 (through the newest release)
CVE-2026-32308
Affects 4.0.3 to 4.0.69 (through the newest release)
CVE-2026-32306
Affects 4.0.3 to 4.0.69 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

CVE-2026-33142High 8.1
OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
Affected: fixed in 10.0.34.
No fix released. The advisory names 10.0.34 as the fix, which the registry doesn't have yet. The latest release, 4.0.69, is still affected.
100% of oneuptime downloads last week were affected versions (99).
CVE-2026-33143High 8.7
OneUptime: WhatsApp Webhook Missing Signature Verification
Affected: fixed in 10.0.34.
No fix released. The advisory names 10.0.34 as the fix, which the registry doesn't have yet. The latest release, 4.0.69, is still affected.
100% of oneuptime downloads last week were affected versions (99).
CVE-2026-32598Medium 6.9
OneUptime: Password Reset Token Logged at INFO Level
Affected: fixed in 10.0.23.
No fix released. The advisory names 10.0.23 as the fix, which the registry doesn't have yet. The latest release, 4.0.69, is still affected.
100% of oneuptime downloads last week were affected versions (99).
CVE-2026-32308High 7.6
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
Affected: fixed in 10.0.23.
No fix released. The advisory names 10.0.23 as the fix, which the registry doesn't have yet. The latest release, 4.0.69, is still affected.
100% of oneuptime downloads last week were affected versions (99).
CVE-2026-32306Critical 10.0
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
Affected: fixed in 10.0.23.
No fix released. The advisory names 10.0.23 as the fix, which the registry doesn't have yet. The latest release, 4.0.69, is still affected.
100% of oneuptime downloads last week were affected versions (99).