npm/@cap-js/postgres CVE-2026-46421: critical 9.3, EPSS 0.52%
Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)
Action: Upgrade @cap-js/postgres to 2.3.0 or later.
npm i @cap-js/postgres@2.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.2.2 | 2.3.0 | - |
Fixed versions
| 2.3.0 |
Sources
- osv: GHSA-pvw4-cvr4-97p8#npm/@cap-js/postgres
- nvd: CVE-2026-46421
- https://github.com/cap-js/cds-dbs/security/advisories/GHSA-pvw4-cvr4-97p8
- https://github.com/cap-js/cds-dbs
- https://me.sap.com/notes/3747787
- https://www.sap.com/documents/2026/05/8203a8b9-4d7f-0010-bca6-c68f7e60039b.html
- https://www.stepsecurity.io/blog/a-mini-shai-hulud-has-appeared
CVE-2026-46421 · published · modified · JSON