Go/github.com/QuantumNous/new-api CVE-2026-25591: medium 6.5, EPSS 0.57%
New API has an SQL LIKE Wildcard Injection DoS via Token Search
Action: Upgrade github.com/QuantumNous/new-api to 0.10.8-alpha.10 or later.
go get github.com/QuantumNous/new-api@v0.10.8-alpha.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.10.8-alpha.10 | - |
Fixed versions
| 0.10.8-alpha.10 |
Sources
- osv: GHSA-w6x6-9fp7-fqm4
- nvd: CVE-2026-25591
- https://github.com/QuantumNous/new-api/security/advisories/GHSA-w6x6-9fp7-fqm4
- https://github.com/QuantumNous/new-api/commit/3e1be18310f35d20742683ca9e4bf3bcafc173c5
- https://github.com/QuantumNous/new-api
- https://github.com/QuantumNous/new-api/releases/tag/v0.10.8-alpha.10
- https://pkg.go.dev/vuln/GO-2026-4531
CVE-2026-25591 · published · modified · JSON