limbo.watch
Menu

Likely permanent: GitHub doesn’t review this ecosystem

GHSA-fqr5-mf8g-p5m2

nangohq/nango (self-hosted server & Nango Cloud) on other · published in nangohq/nango

Read the advisory on GitHub ↗

Fixed in 688df05f3e15aa0e5ddca632a40c4fb06f294a38. Dependabot, npm audit and OSV-Scanner probably never will. Find it in your project

Facts

Severity
High · CVSS score 8.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Affected versions
before commit 688df05f3e15aa0e5ddca632a40c4fb06f294a38As entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it
Fixed in
688df05f3e15aa0e5ddca632a40c4fb06f294a38
CVE
None cited by the advisory
GitHub Advisory Database
Not reviewed
OSV.dev
Not present
Other CVEs pointing here
None found in the CVE List

If you use nangohq/nango (self-hosted server & Nango Cloud) before commit 688df05f3e15aa0e5ddca632a40c4fb06f294a38

Upgrade to 688df05f3e15aa0e5ddca632a40c4fb06f294a38 or later. Dependabot, npm audit and OSV-Scanner probably never will.

Timeline

  1. 2026-08-26 12:05 UTC

    Published by the maintainers

    No CVE cited

  2. 2026-10-31 12:46 UTC

    First seen by Limbowatch

    not reviewed · not in OSV

  3. Not expected

    Reviewed by GitHub

    GitHub doesn’t review this ecosystem

Machine-readable record: feed/GHSA-fqr5-mf8g-p5m2.json