Skip to main content
cve.nowby Sazabi
← npm
npmPackage

rollup

2 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
4.68.0 (Nov 6, 2026): no advisory affects it
Newest unaffected release
4.68.0 (Nov 6, 2026), the latest release
Advisories
2 · 1 high, 1 medium
Weekly downloads
161.3M
Releases
500+ since 2.26.8 (Aug 29, 2020)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-27606
    Affects 2.26.8 to 2.79.2 (2.80.0 is outside it); 3.0.0 to 3.29.5 (3.30.0 is outside it); 4.0.0 to 4.58.0 (4.59.0 is outside it)
  • CVE-2024-47068
    Affects 2.26.8 to 2.79.1 (2.79.2 is outside it); 3.0.0 to 3.29.4 (3.29.5 is outside it); 4.0.0 to 4.22.3 (4.22.4 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 2

  • Rollup 4 has Arbitrary File Write via Path Traversal

    Affected: fixed in 2.80.0; from 3.0.0, fixed in 3.30.0; from 4.0.0, fixed in 4.59.0.

    Fixed in 2.80.0 (released Feb 22, 2026, 3 days before disclosure), 3.30.0 (released Feb 22, 2026, 3 days before disclosure) and 4.59.0 (released Feb 22, 2026, 3 days before disclosure).

    The latest release, 4.68.0, is not affected.

    27% of rollup downloads last week were affected versions (49M).

  • CVE-2024-47068Medium 6.1

    DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

    Affected: from 3.0.0, fixed in 3.29.5; from 4.0.0, fixed in 4.22.4; fixed in 2.79.2.

    Fixed in 2.79.2 (released Sep 26, 2024, 3 days after disclosure), 3.29.5 (released Sep 21, 2024, 2 days before disclosure) and 4.22.4 (released Sep 21, 2024, 2 days before disclosure).

    The latest release, 4.68.0, is not affected.

    4.8% of rollup downloads last week were affected versions (8.7M).