Skip to content
OpenAdvisories

Product · sigstore

sigstore-js

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.4
    CVE-2026-118763

    @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization and Docker configuration headers as defaults on a share…

    sigstore sigstore-js @sigstore/oci npm
  • High 7.5
    CVE-2026-48815

    sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OID…

    sigstore sigstore-js pulumi-language-nodejs sigstore Wolfi npm