# unleash-server (npm) vulnerabilities 7 known vulnerabilities (2 high, 4 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 8.3.1 (Oct 29, 2026): no advisory affects it - Newest unaffected release: 8.3.1 (Oct 29, 2026), the latest release - Weekly downloads: 20.7K - Dependents: 0 - Releases: 500+ since 4.19.5 (Jun 6, 2023) - Registry: https://www.npmjs.com/package/unleash-server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-77426: 4.19.5 to 8.0.2 (8.0.3 is outside it) - CVE-2026-77425: 4.19.5 to 8.0.2 (8.0.3 is outside it) - CVE-2026-76910: 4.19.5 to 8.0.2 (8.0.3 is outside it) - CVE-2026-76909: 4.19.5 to 8.0.2 (8.0.3 is outside it) - CVE-2026-63466: 4.19.5 to 8.0.2 (8.0.3 is outside it) - CVE-2026-63462: 4.19.5 to 7.5.1 (7.5.2 is outside it); 7.6.1 to 7.6.5-beta.2 (7.6.5 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it) - CVE-2026-63004: 4.19.5 to 7.5.1 (7.5.2 is outside it); 7.6.1 to 7.6.5-beta.2 (7.6.5 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (7) ### [CVE-2026-77426](https://cve.now/CVE-2026-77426): Unleash: Missing await on permission check + cross-project IDOR in admin API - Severity: High 7.1 - Published: Sep 22, 2026 - Affected: fixed in 8.0.3. - Fixed in 8.0.3 (released Jul 10, 2026, 74 days before disclosure). - The latest release, 8.3.1, is not affected. - 96% of unleash-server downloads last week were affected versions (85K). ### [CVE-2026-77425](https://cve.now/CVE-2026-77425): Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write)… - Severity: Medium 4.3 - Published: Sep 22, 2026 - Affected: fixed in 8.0.3. - Fixed in 8.0.3 (released Jul 10, 2026, 74 days before disclosure). - The latest release, 8.3.1, is not affected. - 96% of unleash-server downloads last week were affected versions (85K). ### [CVE-2026-76910](https://cve.now/CVE-2026-76910): Unleash: Clone-feature lets a user copy a feature from a project they cannot read - Severity: Medium 5.3 - Published: Sep 22, 2026 - Affected: fixed in 8.0.3. - Fixed in 8.0.3 (released Jul 10, 2026, 74 days before disclosure). - The latest release, 8.3.1, is not affected. - 96% of unleash-server downloads last week were affected versions (85K). ### [CVE-2026-76909](https://cve.now/CVE-2026-76909): Unleash: CR-approval email renders user-controlled raw HTML - Severity: Low 2.1 - Published: Sep 22, 2026 - Affected: fixed in 8.0.3. - Fixed in 8.0.3 (released Jul 10, 2026, 74 days before disclosure). - The latest release, 8.3.1, is not affected. - 96% of unleash-server downloads last week were affected versions (85K). ### [CVE-2026-63466](https://cve.now/CVE-2026-63466): Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username - Severity: Medium 4.1 - Published: Aug 21, 2026 - Affected: fixed in 8.0.3. - Fixed in 8.0.3 (released Jul 10, 2026, 42 days before disclosure). - The latest release, 8.3.1, is not affected. - 96% of unleash-server downloads last week were affected versions (85K). ### [CVE-2026-63462](https://cve.now/CVE-2026-63462): Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter - Severity: High 7.5 - Published: Aug 21, 2026 - Affected: fixed in 7.5.2; from 7.6.0, fixed in 7.6.5; from 8.0.0, fixed in 8.0.2. - Fixed in 7.5.2 (released Jun 29, 2026, 53 days before disclosure), 7.6.5 (released Jun 29, 2026, 53 days before disclosure) and 8.0.2 (released Jun 29, 2026, 53 days before disclosure). - The latest release, 8.3.1, is not affected. - 90% of unleash-server downloads last week were affected versions (79.8K). ### [CVE-2026-63004](https://cve.now/CVE-2026-63004): Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata… - Severity: Medium 5.5 - Published: Aug 21, 2026 - Affected: fixed in 7.5.2; from 7.6.0, fixed in 7.6.5; from 8.0.0, fixed in 8.0.2. - Fixed in 7.5.2 (released Jun 29, 2026, 53 days before disclosure), 7.6.5 (released Jun 29, 2026, 53 days before disclosure) and 8.0.2 (released Jun 29, 2026, 53 days before disclosure). - The latest release, 8.3.1, is not affected. - 90% of unleash-server downloads last week were affected versions (79.8K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/unleash-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.