npm/@sigstore/verify CVE-2026-48816: medium 6.5, EPSS 0.14%
sigstore-js has Insufficient Verification of Data Authenticity
Action: Upgrade @sigstore/verify to 3.1.1 or later.
npm i @sigstore/verify@3.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.1.0 | 3.1.1 | - |
Fixed versions
| 3.1.1 |
Sources
- osv: GHSA-xgjw-pm74-86q4
- https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4
- https://github.com/sigstore/sigstore-js
CVE-2026-48816 · published · modified · JSON