Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

headroom-ai

3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
0.43.1 (Nov 5, 2026): no advisory affects it
Newest unaffected release
0.43.1 (Nov 5, 2026), the latest release
Advisories
3 · 1 critical, 2 high
Weekly downloads
125.8K
Dependents
13
Releases
206 since 0.2.0 (Jan 10, 2026)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

    Affected: fixed in 0.35.0.

    Fixed in 0.35.0 (released Aug 13, 2026, 29 days before disclosure).

    The latest release, 0.43.1, is not affected.

  • CVE-2026-77776Critical 9.1

    Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity

    Affected: fixed in 0.36.1.

    Fixed in 0.36.1 (released Aug 21, 2026, the day of disclosure).

    The latest release, 0.43.1, is not affected.

  • Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation

    Affected: fixed in 0.36.1.

    Fixed in 0.36.1 (released Aug 21, 2026, the day of disclosure).

    The latest release, 0.43.1, is not affected.