npm/preact CVE-2026-22028: medium 6.1, EPSS 0.27%
Preact has JSON VNode Injection issue
Action: Upgrade preact to 10.26.10 or later.
npm i preact@10.26.10npm i preact@10.27.3npm i preact@10.28.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 10.26.5 | 10.26.10 | - |
| 10.27.0 | 10.27.3 | - |
| 10.28.0 | 10.28.2 | - |
Fixed versions
| 10.26.10 | 10.27.3 | 10.28.2 |
Sources
- osv: GHSA-36hm-qxxp-pg3m
- nvd: CVE-2026-22028
- https://github.com/preactjs/preact/security/advisories/GHSA-36hm-qxxp-pg3m
- https://github.com/preactjs/preact
CVE-2026-22028 · published · modified · JSON