{"action":"Upgrade @haxtheweb/haxcms-nodejs to 26.0.0 or later.","affected":[{"fixed":"26.0.0","introduced":"0"}],"component":"@haxtheweb/haxcms-nodejs","cve_ids":["CVE-2026-46395"],"ecosystem":"npm","epss":0.00295,"exploited":false,"fixed_versions":["26.0.0"],"ghsa_id":"GHSA-6c8g-9hfh-pq5h","id":"tcs_01M5KF6N7XTFSGND2FV22VVCNG","modified_at":"2026-09-10T03:50:45.797956966Z","published_at":"2026-05-19T14:44:55Z","references":["https://osv.dev/vulnerability/GHSA-6c8g-9hfh-pq5h","https://github.com/haxtheweb/issues/security/advisories/GHSA-6c8g-9hfh-pq5h","https://nvd.nist.gov/vuln/detail/CVE-2026-46395","https://github.com/haxtheweb/issues"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-6c8g-9hfh-pq5h","url":"https://osv.dev/vulnerability/GHSA-6c8g-9hfh-pq5h"},{"source":"nvd","source_id":"CVE-2026-46395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46395"}],"summary":"HAXcms: Private Key Disclosure via Broken HMAC Implementation"}