npm/@cloudflare/workers-oauth-provider CVE-2025-4144: critical 9.8, EPSS 0.58%
@cloudflare/workers-oauth-provider PKCE bypass via downgrade attack
Action: Upgrade @cloudflare/workers-oauth-provider to 0.0.5 or later.
npm i @cloudflare/workers-oauth-provider@0.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.0.5 | - |
Fixed versions
| 0.0.5 |
Sources
- osv: GHSA-qgp8-v765-qxx9
- nvd: CVE-2025-4144
- https://github.com/cloudflare/workers-oauth-provider/security/advisories/GHSA-qgp8-v765-qxx9
- https://github.com/cloudflare/workers-oauth-provider/pull/27
- https://github.com/cloudflare/workers-oauth-provider
CVE-2025-4144 · published · modified · JSON