Skip to content
OpenAdvisories

Package · npm

misskey-js

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.9
    CVE-2025-66482

    Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

    Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (`tru…

    misskey-dev misskey misskey-js npm
  • High 7.1
    CVE-2025-66402

    misskey.js's export data contains private post data

    Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 f…

    misskey-dev misskey misskey-js npm