npm/ep_etherpad-lite CVE-2026-55087: medium 6.1, EPSS 0.58%

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

Action: Upgrade ep_etherpad-lite to 3.1.0 or later.

npm i ep_etherpad-lite@3.1.0

Affected

Fixed versions

Sources

• osv: GHSA-fjgc-3mj7-8rg8
• https://github.com/ether/etherpad/security/advisories/GHSA-fjgc-3mj7-8rg8
• https://github.com/ether/etherpad/pull/6399
• https://github.com/ether/etherpad/pull/7710
• https://github.com/ether/etherpad/pull/7784
• https://github.com/ether/etherpad/commit/451bd9c3ebb0dded99dd0ff21811ee00e0940c29
• https://github.com/ether/etherpad/commit/63e9b2d4eb303cd341022591bdf9484584db36e3
• https://github.com/ether/etherpad

CVE-2026-55087 · published 2026-08-13T13:46:07Z · modified 2026-08-13T14:10:58.719555Z · JSON