npm/pubnub CVE-2023-26154: medium 5.9, EPSS 0.96%

pubnub Insufficient Entropy vulnerability

Action: Upgrade pubnub to 7.4.0 or later.

npm i pubnub@7.4.0

Affected

Fixed versions

Sources

• osv: GHSA-5844-q3fc-56rh
• https://nvd.nist.gov/vuln/detail/CVE-2023-26154
• https://github.com/pubnub/go/commit/428517fef5b901db7275d9f5a75eda89a4c28e08
• https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119
• https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379
• https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381
• https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378
• https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377
• https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375
• https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385
• https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376
• https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690
• https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380
• https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373
• https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372
• https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pubnub/CVE-2023-26154.yml
• https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js#L70
• https://github.com/pubnub/javascript
• https://github.com/advisories/GHSA-5844-q3fc-56rh
• https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0

CVE-2023-26154 · published 2023-12-06T06:30:20Z · modified 2026-07-07T17:56:14.430840384Z · JSON