limbo.watch
Menu

Likely permanent: GitHub doesn’t review this ecosystem

GHSA-2786-p4vj-vx8x

dai-shi/use-reducer-async on github · published in dai-shi/use-reducer-async

Read the advisory on GitHub ↗

Facts

Severity
Critical
Affected versions
>= da72edbde5705efcec6c62e0a3dcb73687b78dc8, <= df07d5711458d8b46e11dd7afaaa21e88cafabfbAs entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it
Fixed in
not stated
CVE
CVE-2026-48159 · published
GitHub Advisory Database
Not reviewed
OSV.dev
Not present
Other CVEs pointing here
None found in the CVE List

If you use dai-shi/use-reducer-async >= da72edbde5705efcec6c62e0a3dcb73687b78dc8, <= df07d5711458d8b46e11dd7afaaa21e88cafabfb

No fixed version is listed yet. Check the advisory for workarounds. Dependabot, npm audit and OSV-Scanner probably never will.

Timeline

  1. 2026-05-22 04:44 UTC

    Published by the maintainers

    Cites CVE-2026-48159

  2. 2026-10-31 12:45 UTC

    First seen by Limbowatch

    not reviewed · not in OSV

  3. Not expected

    Reviewed by GitHub

    GitHub doesn’t review this ecosystem

Machine-readable record: feed/GHSA-2786-p4vj-vx8x.json