Skip to content
OpenAdvisories

Package · npm

sigstore

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.5
    CVE-2026-48815

    sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OID…

    sigstore sigstore-js pulumi-language-nodejs sigstore Wolfi npm