npmPackage

unleash-server

7 known vulnerabilities (2 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 8.3.1 (Oct 29, 2026): no advisory affects it
Newest unaffected release: 8.3.1 (Oct 29, 2026), the latest release
Advisories: 7 · 2 high, 4 medium, 1 low

Weekly downloads: 20.7K
Dependents: 0
Releases: 500+ since 4.19.5 (Jun 6, 2023)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-77426
Affects 4.19.5 to 8.0.2 (8.0.3 is outside it)
CVE-2026-77425
Affects 4.19.5 to 8.0.2 (8.0.3 is outside it)
CVE-2026-76910
Affects 4.19.5 to 8.0.2 (8.0.3 is outside it)
CVE-2026-76909
Affects 4.19.5 to 8.0.2 (8.0.3 is outside it)
CVE-2026-63466
Affects 4.19.5 to 8.0.2 (8.0.3 is outside it)
CVE-2026-63462
Affects 4.19.5 to 7.5.1 (7.5.2 is outside it); 7.6.1 to 7.6.5-beta.2 (7.6.5 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it)
CVE-2026-63004
Affects 4.19.5 to 7.5.1 (7.5.2 is outside it); 7.6.1 to 7.6.5-beta.2 (7.6.5 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 7

CVE-2026-77426High 7.1
Unleash: Missing await on permission check + cross-project IDOR in admin API
Affected: fixed in 8.0.3.
Fixed in 8.0.3 (released Jul 10, 2026, 74 days before disclosure).
The latest release, 8.3.1, is not affected.
96% of unleash-server downloads last week were affected versions (85K).
CVE-2026-77425Medium 4.3
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write)…
Affected: fixed in 8.0.3.
Fixed in 8.0.3 (released Jul 10, 2026, 74 days before disclosure).
The latest release, 8.3.1, is not affected.
96% of unleash-server downloads last week were affected versions (85K).
CVE-2026-76910Medium 5.3
Unleash: Clone-feature lets a user copy a feature from a project they cannot read
Affected: fixed in 8.0.3.
Fixed in 8.0.3 (released Jul 10, 2026, 74 days before disclosure).
The latest release, 8.3.1, is not affected.
96% of unleash-server downloads last week were affected versions (85K).
CVE-2026-76909Low 2.1
Unleash: CR-approval email renders user-controlled raw HTML
Affected: fixed in 8.0.3.
Fixed in 8.0.3 (released Jul 10, 2026, 74 days before disclosure).
The latest release, 8.3.1, is not affected.
96% of unleash-server downloads last week were affected versions (85K).
CVE-2026-63466Medium 4.1
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
Affected: fixed in 8.0.3.
Fixed in 8.0.3 (released Jul 10, 2026, 42 days before disclosure).
The latest release, 8.3.1, is not affected.
96% of unleash-server downloads last week were affected versions (85K).
CVE-2026-63462High 7.5
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
Affected: fixed in 7.5.2; from 7.6.0, fixed in 7.6.5; from 8.0.0, fixed in 8.0.2.
Fixed in 7.5.2 (released Jun 29, 2026, 53 days before disclosure), 7.6.5 (released Jun 29, 2026, 53 days before disclosure) and 8.0.2 (released Jun 29, 2026, 53 days before disclosure).
The latest release, 8.3.1, is not affected.
90% of unleash-server downloads last week were affected versions (79.8K).
CVE-2026-63004Medium 5.5
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata…
Affected: fixed in 7.5.2; from 7.6.0, fixed in 7.6.5; from 8.0.0, fixed in 8.0.2.
Fixed in 7.5.2 (released Jun 29, 2026, 53 days before disclosure), 7.6.5 (released Jun 29, 2026, 53 days before disclosure) and 8.0.2 (released Jun 29, 2026, 53 days before disclosure).
The latest release, 8.3.1, is not affected.
90% of unleash-server downloads last week were affected versions (79.8K).