Go/github.com/QuantumNous/new-api CVE-2026-25591: medium 6.5, EPSS 0.57%

New API has an SQL LIKE Wildcard Injection DoS via Token Search in github.com/QuantumNous/new-api

Action: Upgrade github.com/QuantumNous/new-api to 0.10.8-alpha.10 or later.

go get github.com/QuantumNous/new-api@v0.10.8-alpha.10

Affected

Fixed versions

Sources

• osv: GO-2026-4531
• nvd: CVE-2026-25591
• https://github.com/QuantumNous/new-api/security/advisories/GHSA-w6x6-9fp7-fqm4
• https://github.com/QuantumNous/new-api/commit/3e1be18310f35d20742683ca9e4bf3bcafc173c5
• https://github.com/QuantumNous/new-api/releases/tag/v0.10.8-alpha.10

CVE-2026-25591 · published 2026-02-25T23:07:04Z · modified 2026-02-25T23:40:58.977199Z · JSON