Skip to content
Security
فارسی
Sign in / Register
Vulnerabilities
Products
Plugins
All products
github.com/centrifugal/centrifugo/v4
Go
· Package
5 reports
Vulnerability alerts
Follow
Package, identifier or title
Search
Severity
All
Critical
High
Medium
Low
Unknown
Fix status
All
Fix reported
No fix reported
Sort by
Recently updated
Highest severity
Report
Product
Ecosystem
Severity
Fix status
Last updated
Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
CVE-2026-71485 · GHSA-9468-V6MJ-FPPW
Version ranges need review.
github.com/centrifugal/centrifugo/v3
github.com/centrifugal/centrifugo/v4
Go
Critical
Fix reported
2026-09-28
Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass
CVE-2026-49998 · GHSA-G6VG-WJ8F-48CJ
Version ranges need review.
github.com/centrifugal/centrifugo/v3
github.com/centrifugal/centrifugo/v4
Go
High
Fix reported
2026-07-07
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
CVE-2026-32301 · GHSA-J77H-RR39-C552
Version ranges need review.
github.com/centrifugal/centrifugo/v3
github.com/centrifugal/centrifugo/v4
Go
Critical
Fix reported
2026-03-28
Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning
GHSA-Q926-C743-49QJ · GO-2026-4703
Version ranges need review.
github.com/centrifugal/centrifugo/v3
github.com/centrifugal/centrifugo/v4
Go
Low
Fix reported
2026-03-28
Centrifugo v6.6.0 dependency vulnerabilities
GHSA-J9WF-6R2X-HQMX · GO-2026-4528
Version ranges need review.
github.com/centrifugal/centrifugo/v3
github.com/centrifugal/centrifugo/v4
Go
Medium
Fix reported
2026-02-23
