npmPackage

trigger.dev

9 known vulnerabilities (1 critical, 3 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release: 4.8.3 (Oct 30, 2026): no advisory affects it
Newest unaffected release: 4.8.3 (Oct 30, 2026), the latest release
Advisories: 9 · 1 critical, 3 high, 5 medium

Weekly downloads: 1.2M
Dependents: 1
Releases: 500+ since 3.0.0 (Sep 16, 2024)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-114088
Affects 0.0.0-bun-1-4-4-20261026160903 to 4.5.3 (4.5.4 is outside it)
CVE-2026-114087
Affects 0.0.0-bun-1-4-4-20261026160903 to 4.5.5 (4.5.6 is outside it)
CVE-2026-114086
Affects 0.0.0-bun-1-4-4-20261026160903 to 4.5.4 (4.5.5 is outside it)
CVE-2026-114081
Affects 0.0.0-bun-1-4-4-20261026160903 to 4.5.5 (4.5.6 is outside it)
CVE-2026-114079
Affects 0.0.0-bun-1-4-4-20261026160903 to 4.5.5 (4.5.6 is outside it)
CVE-2026-114076
Affects 0.0.0-bun-1-4-4-20261026160903 to 4.5.1 (4.5.2 is outside it)
CVE-2026-114073
Affects 0.0.0-bun-1-4-4-20261026160903 to 4.5.8 (4.5.9 is outside it)
CVE-2026-85651
Affects 0.0.0-bun-1-4-4-20261026160903 to 4.5.1 (4.5.2 is outside it)
CVE-2026-85650
Affects 0.0.0-bun-1-4-4-20261026160903 to 4.5.1 (4.5.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 9

CVE-2026-114088High 8.3
Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO
Affected: fixed in 4.5.4.
Fixed in 4.5.4 (released Jul 14, 2026, 99 days before disclosure).
The latest release, 4.8.3, is not affected.
15% of trigger.dev downloads last week were affected versions (175.6K).
CVE-2026-114087Critical 9.2
Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets
Affected: fixed in 4.5.6.
Fixed in 4.5.6 (released Jul 21, 2026, 92 days before disclosure).
The latest release, 4.8.3, is not affected.
16% of trigger.dev downloads last week were affected versions (186.7K).
CVE-2026-114086Medium 6.9
Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint
Affected: fixed in 4.5.5.
Fixed in 4.5.5 (released Jul 20, 2026, 93 days before disclosure).
The latest release, 4.8.3, is not affected.
16% of trigger.dev downloads last week were affected versions (186.5K).
CVE-2026-114081High 8.3
Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name
Affected: fixed in 4.5.6.
Fixed in 4.5.6 (released Jul 21, 2026, 92 days before disclosure).
The latest release, 4.8.3, is not affected.
16% of trigger.dev downloads last week were affected versions (186.7K).
CVE-2026-114079Medium 5.3
Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint
Affected: fixed in 4.5.6.
Fixed in 4.5.6 (released Jul 21, 2026, 92 days before disclosure).
The latest release, 4.8.3, is not affected.
16% of trigger.dev downloads last week were affected versions (186.7K).
CVE-2026-114076Medium 5.3
Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL
Affected: fixed in 4.5.2.
Fixed in 4.5.2 (released Jul 9, 2026, 104 days before disclosure).
The latest release, 4.8.3, is not affected.
15% of trigger.dev downloads last week were affected versions (172.2K).
CVE-2026-114073Medium 6.8
Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs
Affected: fixed in 4.5.9.
Fixed in 4.5.9 (released Jul 30, 2026, 83 days before disclosure).
The latest release, 4.8.3, is not affected.
19% of trigger.dev downloads last week were affected versions (219.2K).
CVE-2026-85651High 8.4
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
Affected: fixed in 4.5.2.
Fixed in 4.5.2 (released Jul 9, 2026, 57 days before disclosure).
The latest release, 4.8.3, is not affected.
15% of trigger.dev downloads last week were affected versions (172.2K).
CVE-2026-85650Medium 5.3
Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel
Affected: fixed in 4.5.2.
Fixed in 4.5.2 (released Jul 9, 2026, 57 days before disclosure).
The latest release, 4.8.3, is not affected.
15% of trigger.dev downloads last week were affected versions (172.2K).