{"action":"Upgrade @digitalbazaar/zcap to 9.0.1 or later.","affected":[{"fixed":"9.0.1","introduced":"0"}],"component":"@digitalbazaar/zcap","cve_ids":["CVE-2024-31995"],"ecosystem":"npm","epss":0.00441,"exploited":false,"fixed_versions":["9.0.1"],"ghsa_id":"GHSA-hp8h-7x69-4wmv","id":"tcs_01M5KFVP0VEYHRE9AW51T24EMZ","modified_at":"2026-09-10T03:50:11.358221686Z","published_at":"2024-04-10T17:16:15Z","references":["https://osv.dev/vulnerability/GHSA-hp8h-7x69-4wmv","https://github.com/digitalbazaar/zcap/security/advisories/GHSA-hp8h-7x69-4wmv","https://nvd.nist.gov/vuln/detail/CVE-2024-31995","https://github.com/digitalbazaar/zcap/pull/82","https://github.com/digitalbazaar/zcap/commit/261eea040109b6e25159c88d8ed49d3c37f8fcfe","https://github.com/digitalbazaar/zcap/commit/55f8549c80124b85dfb0f3dcf83f2c63f42532e5","https://github.com/digitalbazaar/zcap"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-hp8h-7x69-4wmv","url":"https://osv.dev/vulnerability/GHSA-hp8h-7x69-4wmv"}],"summary":"zcap has incomplete expiration checks in capability chains."}