npm/neotoma CVE-2026-45577: medium, EPSS 0.25%

Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass

Action: Upgrade neotoma to 0.11.1 or later.

npm i neotoma@0.11.1

Affected

Fixed versions

Sources

• osv: GHSA-5cvp-p7p4-mcx9
• https://github.com/markmhendrickson/neotoma/security/advisories/GHSA-5cvp-p7p4-mcx9
• https://nvd.nist.gov/vuln/detail/CVE-2026-45577
• https://github.com/markmhendrickson/neotoma
• https://github.com/markmhendrickson/neotoma/releases/tag/v0.11.1

CVE-2026-45577 · published 2026-05-18T14:20:06Z · modified 2026-06-09T10:45:13.948548997Z · JSON