npm/replicator CVE-2026-2265: medium 6.5, EPSS 0.40%
Replicator deserializes untrusted user input
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.0.5 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-2gmp-34j9-fqjm
- https://nvd.nist.gov/vuln/detail/CVE-2026-2265
- https://github.com/inikulin/replicator/pull/19
- https://github.com/inikulin/replicator
- https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data
CVE-2026-2265 · published · modified · JSON