# trigger.dev (npm) vulnerabilities 9 known vulnerabilities (1 critical, 3 high, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.8.3 (Oct 30, 2026): no advisory affects it - Newest unaffected release: 4.8.3 (Oct 30, 2026), the latest release - Weekly downloads: 1.2M - Dependents: 1 - Releases: 500+ since 3.0.0 (Sep 16, 2024) - Registry: https://www.npmjs.com/package/trigger.dev - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-114088: 0.0.0-bun-1-4-4-20261026160903 to 4.5.3 (4.5.4 is outside it) - CVE-2026-114087: 0.0.0-bun-1-4-4-20261026160903 to 4.5.5 (4.5.6 is outside it) - CVE-2026-114086: 0.0.0-bun-1-4-4-20261026160903 to 4.5.4 (4.5.5 is outside it) - CVE-2026-114081: 0.0.0-bun-1-4-4-20261026160903 to 4.5.5 (4.5.6 is outside it) - CVE-2026-114079: 0.0.0-bun-1-4-4-20261026160903 to 4.5.5 (4.5.6 is outside it) - CVE-2026-114076: 0.0.0-bun-1-4-4-20261026160903 to 4.5.1 (4.5.2 is outside it) - CVE-2026-114073: 0.0.0-bun-1-4-4-20261026160903 to 4.5.8 (4.5.9 is outside it) - CVE-2026-85651: 0.0.0-bun-1-4-4-20261026160903 to 4.5.1 (4.5.2 is outside it) - CVE-2026-85650: 0.0.0-bun-1-4-4-20261026160903 to 4.5.1 (4.5.2 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (9) ### [CVE-2026-114088](https://cve.now/CVE-2026-114088): Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO - Severity: High 8.3 - Published: Oct 21, 2026 - Affected: fixed in 4.5.4. - Fixed in 4.5.4 (released Jul 14, 2026, 99 days before disclosure). - The latest release, 4.8.3, is not affected. - 15% of trigger.dev downloads last week were affected versions (175.6K). ### [CVE-2026-114087](https://cve.now/CVE-2026-114087): Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets - Severity: Critical 9.2 - Published: Oct 21, 2026 - Affected: fixed in 4.5.6. - Fixed in 4.5.6 (released Jul 21, 2026, 92 days before disclosure). - The latest release, 4.8.3, is not affected. - 16% of trigger.dev downloads last week were affected versions (186.7K). ### [CVE-2026-114086](https://cve.now/CVE-2026-114086): Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint - Severity: Medium 6.9 - Published: Oct 21, 2026 - Affected: fixed in 4.5.5. - Fixed in 4.5.5 (released Jul 20, 2026, 93 days before disclosure). - The latest release, 4.8.3, is not affected. - 16% of trigger.dev downloads last week were affected versions (186.5K). ### [CVE-2026-114081](https://cve.now/CVE-2026-114081): Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name - Severity: High 8.3 - Published: Oct 21, 2026 - Affected: fixed in 4.5.6. - Fixed in 4.5.6 (released Jul 21, 2026, 92 days before disclosure). - The latest release, 4.8.3, is not affected. - 16% of trigger.dev downloads last week were affected versions (186.7K). ### [CVE-2026-114079](https://cve.now/CVE-2026-114079): Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint - Severity: Medium 5.3 - Published: Oct 21, 2026 - Affected: fixed in 4.5.6. - Fixed in 4.5.6 (released Jul 21, 2026, 92 days before disclosure). - The latest release, 4.8.3, is not affected. - 16% of trigger.dev downloads last week were affected versions (186.7K). ### [CVE-2026-114076](https://cve.now/CVE-2026-114076): Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL - Severity: Medium 5.3 - Published: Oct 21, 2026 - Affected: fixed in 4.5.2. - Fixed in 4.5.2 (released Jul 9, 2026, 104 days before disclosure). - The latest release, 4.8.3, is not affected. - 15% of trigger.dev downloads last week were affected versions (172.2K). ### [CVE-2026-114073](https://cve.now/CVE-2026-114073): Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs - Severity: Medium 6.8 - Published: Oct 21, 2026 - Affected: fixed in 4.5.9. - Fixed in 4.5.9 (released Jul 30, 2026, 83 days before disclosure). - The latest release, 4.8.3, is not affected. - 19% of trigger.dev downloads last week were affected versions (219.2K). ### [CVE-2026-85651](https://cve.now/CVE-2026-85651): Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay - Severity: High 8.4 - Published: Sep 4, 2026 - Affected: fixed in 4.5.2. - Fixed in 4.5.2 (released Jul 9, 2026, 57 days before disclosure). - The latest release, 4.8.3, is not affected. - 15% of trigger.dev downloads last week were affected versions (172.2K). ### [CVE-2026-85650](https://cve.now/CVE-2026-85650): Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel - Severity: Medium 5.3 - Published: Sep 4, 2026 - Affected: fixed in 4.5.2. - Fixed in 4.5.2 (released Jul 9, 2026, 57 days before disclosure). - The latest release, 4.8.3, is not affected. - 15% of trigger.dev downloads last week were affected versions (172.2K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/trigger.dev Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.