Skip to content
OpenAdvisories

Package · Wolfi

langfuse-3

145 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-114139

    Sentry-Javascript: Middleware Bypass when using Tunnel route

    Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel re…

    getsentry sentry-javascript langfuse-3-worker langfuse-3 Wolfi npm
  • Critical 9.1
    CVE-2026-73420

    NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

    NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can…

    nextauthjs @auth next-auth core Wolfi npm
  • Critical 9.4
    CVE-2026-41242 Public exploit

    protobufjs has an arbitrary code execution issue

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that…

    protobufjs protobuf.js langfuse-3-worker renovate Wolfi npm
  • Critical 9.1
    CVE-2025-68121

    Unexpected session resumption in crypto/tls

    During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

    Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go