{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.38.1"}],"component":"@budibase/server","cve_ids":["CVE-2026-73410"],"ecosystem":"npm","epss":0.0028,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-v42f-v8xc-j435","id":"tcs_01M5KGANG1161DASZD8FNEHQKH","modified_at":"2026-08-12T19:40:59.053071Z","published_at":"2026-07-24T21:44:27Z","references":["https://osv.dev/vulnerability/GHSA-v42f-v8xc-j435","https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435","https://github.com/Budibase/budibase/pull/19178","https://github.com/Budibase/budibase/commit/1fecb3fc3497e8db7b60b42cc514ce304ffe3a41","https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3","https://github.com/Budibase/budibase/commit/586802b5706367520d14245e18a7d0cabab0be11","https://github.com/Budibase/budibase","https://github.com/Budibase/budibase/releases/tag/3.39.30"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"GHSA-v42f-v8xc-j435","url":"https://osv.dev/vulnerability/GHSA-v42f-v8xc-j435"}],"summary":"Budibase: SSRF via DNS rebinding in the REST datasource integration"}