npm/turbo CVE-2026-45773: medium 6.5, EPSS 0.12%

Turbo: Login callback CSRF/session fixation

Action: Upgrade turbo to 2.9.14 or later.

npm i turbo@2.9.14

Affected

Fixed versions

Sources

• osv: GHSA-hcf7-66rw-9f5r
• nvd: CVE-2026-45773
• https://github.com/vercel/turborepo/security/advisories/GHSA-hcf7-66rw-9f5r
• https://github.com/vercel/turborepo

CVE-2026-45773 · published 2026-05-19T19:49:52Z · modified 2026-09-10T03:50:47.005813526Z · JSON