npmPackage

whistle

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release: 2.10.13 (Oct 27, 2026): no advisory affects it
Newest unaffected release: 2.10.13 (Oct 27, 2026), the latest release
Advisories: 2 · 2 high

Weekly downloads: 9,998
Dependents: 33
Releases: 500+ since 0.10.1 (May 28, 2016)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-55629
Affects 0.10.1 to 2.10.2 (2.10.3 is outside it)
CVE-2024-55500
Affects 0.10.1 to 2.9.90 (2.9.91 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 2

CVE-2026-55629High 8.7
Whistle: Path traversal
Affected: fixed in 2.10.3.
Fixed in 2.10.3 (released Jun 14, 2026, 32 days before disclosure).
The latest release, 2.10.13, is not affected.
40% of whistle downloads last week were affected versions (3.4K).
CVE-2024-55500High 8.8
Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the…
Affected: through 2.9.90.
Fixed in 2.9.91 (released Dec 8, 2024, 2 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 2.10.13, is not affected.
25% of whistle downloads last week were affected versions (2.1K).