CVE-2025-66482
1 advisory.
npm/misskey-js CVE-2025-66482: medium 6.5, EPSS 0.34%
Misskey has a login rate limit bypass via spoofed X-Forwarded-For header
Action: Upgrade misskey-js to 2025.12.0-alpha.2 or later.
npm i misskey-js@2025.12.0-alpha.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 2025.9.1 | 2025.12.0-alpha.2 | - |
Fixed versions
| 2025.12.0-alpha.2 |
Sources
- osv: GHSA-wwrj-3hvj-prpm
- https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm
- https://nvd.nist.gov/vuln/detail/CVE-2025-66482
- https://github.com/misskey-dev/misskey/commit/5512898463fa8487b9e6488912f35102b91f25f7
- https://github.com/misskey-dev/misskey
CVE-2025-66482 · published · modified · JSON