npm/@backstage/backend-defaults CVE-2026-106493: low 3, EPSS 0.28%

Backstage: Cloud storage catalog locations may cross configured storage boundaries

Action: Upgrade @backstage/backend-defaults to 0.17.8 or later.

npm i @backstage/backend-defaults@0.17.8

Affected

Fixed versions

Sources

• osv: GHSA-xvh9-35w9-42m4#npm/@backstage/backend-defaults
• https://github.com/backstage/backstage/security/advisories/GHSA-xvh9-35w9-42m4
• https://nvd.nist.gov/vuln/detail/CVE-2026-106493
• https://github.com/backstage/backstage/commit/47ddbd8b4a3efd812309f759c38f4877fbd9e5ff
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.6

CVE-2026-106493 · published 2026-10-07T17:59:55Z · modified 2026-10-07T18:15:11.174792016Z · JSON