# uptime-kuma (npm) vulnerabilities 8 known vulnerabilities (1 high, 7 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.0.0-dev.0 (Aug 11, 2023): no advisory affects it - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 81 - Dependents: 0 - Releases: 1 since 2.0.0-dev.0 (Aug 11, 2023) - Registry: https://www.npmjs.com/package/uptime-kuma - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-32230: no published release is affected - CVE-2025-26042: no published release is affected - CVE-2024-56331: no published release is affected - CVE-2023-49804: no published release is affected - CVE-2023-49276: no published release is affected - CVE-2023-44400: no published release is affected - CVE-2023-36822: no published release is affected - CVE-2023-36821: no published release is affected ## Advisories (8) ### [CVE-2026-32230](https://cve.now/CVE-2026-32230): Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page - Severity: Medium 5.3 - Published: Mar 12, 2026 - Affected: from 2.0.0, fixed in 2.2.0. - No fix released. The advisory names 2.2.0 as the fix, which the registry doesn't have yet. - 0% of uptime-kuma downloads last week were affected versions (0). ### [CVE-2025-26042](https://cve.now/CVE-2025-26042): Uptime Kuma \>== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. - Severity: Medium 6.0 - Published: Mar 17, 2025 - Affected: from 1.15.0, through 1.23.16; from 2.0.0-beta.0, fixed in 2.0.0-beta.2. - No fix released. The advisory names 2.0.0-beta.2 as the fix, which the registry doesn't have yet. - 0% of uptime-kuma downloads last week were affected versions (0). ### [CVE-2024-56331](https://cve.now/CVE-2024-56331): Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's \`Real-Browser\` monitor - Severity: Medium 6.8 - Published: Dec 20, 2024 - Affected: from 1.23.0, fixed in 1.23.16; from 2.0.0-beta.0, fixed in 2.0.0-beta.1. - No fix released. The advisory names 1.23.16 and 2.0.0-beta.1 as the fix, which the registry doesn't have yet. - 0% of uptime-kuma downloads last week were affected versions (0). ### [CVE-2023-49804](https://cve.now/CVE-2023-49804): Uptime Kuma Password Change Vulnerability - Severity: Medium 6.7 - Published: Dec 11, 2023 - Affected: fixed in 1.23.9. - No fix released. The advisory names 1.23.9 as the fix, which the registry doesn't have yet. - 0% of uptime-kuma downloads last week were affected versions (0). ### [CVE-2023-49276](https://cve.now/CVE-2023-49276): Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma - Severity: Medium 6.3 - Published: Dec 1, 2023 - Affected: from 1.20.0, fixed in 1.23.7. - No fix released. The advisory names 1.23.7 as the fix, which the registry doesn't have yet. - 0% of uptime-kuma downloads last week were affected versions (0). ### [CVE-2023-44400](https://cve.now/CVE-2023-44400): Uptime Kuma has Persistentent User Sessions - Severity: Medium 6.7 - Published: Oct 9, 2023 - Affected: fixed in 1.23.3. - No fix released. The advisory names 1.23.3 as the fix, which the registry doesn't have yet. - 0% of uptime-kuma downloads last week were affected versions (0). ### [CVE-2023-36822](https://cve.now/CVE-2023-36822): Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss - Severity: Medium 6.5 - Published: Jul 5, 2023 - Affected: fixed in 1.22.1. - No fix released. The advisory names 1.22.1 as the fix, which the registry doesn't have yet. - 0% of uptime-kuma downloads last week were affected versions (0). ### [CVE-2023-36821](https://cve.now/CVE-2023-36821): Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation - Severity: High 8.8 - Published: Jul 5, 2023 - Affected: fixed in 1.22.1. - No fix released. The advisory names 1.22.1 as the fix, which the registry doesn't have yet. - 0% of uptime-kuma downloads last week were affected versions (0). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/uptime-kuma Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.