{
 "affected": [
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "0.2.0",
    "range_converted": true,
    "vulnerable_version_range": "< 0.2.0"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/lch"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "0.2.0"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "0.1.3",
    "range_converted": true,
    "vulnerable_version_range": "< 0.1.3"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/air-gap"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "0.1.3"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.1.6",
    "range_converted": true,
    "vulnerable_version_range": "< 2.1.6"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/amountinator"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.1.6"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "0.1.8",
    "range_converted": true,
    "vulnerable_version_range": "< 0.1.8"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/wallet-helper"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "0.1.8"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "1.1.2",
    "range_converted": true,
    "vulnerable_version_range": "< 1.1.2"
   },
   "package": {
    "ecosystem": "npm",
    "name": "create-bsv-app"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "1.1.2"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "0.2.6",
    "range_converted": true,
    "vulnerable_version_range": "< 0.2.6"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/did"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "0.2.6"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "1.3.2",
    "range_converted": true,
    "vulnerable_version_range": "< 1.3.2"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/did-client"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "1.3.2"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "1.5.2",
    "range_converted": true,
    "vulnerable_version_range": "< 1.5.2"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/fund-wallet"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "1.5.2"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "0.6.0",
    "range_converted": true,
    "vulnerable_version_range": "< 0.6.0"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/simple"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "0.6.0"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "1.10.2",
    "range_converted": true,
    "vulnerable_version_range": "< 1.10.2"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/templates"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "1.10.2"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.1.8",
    "range_converted": true,
    "vulnerable_version_range": "< 2.1.8"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/authsocket"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.1.8"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.1.7",
    "range_converted": true,
    "vulnerable_version_range": "< 2.1.7"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/authsocket-client"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.1.7"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.5.2",
    "range_converted": true,
    "vulnerable_version_range": "< 2.5.2"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/message-box-client"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.5.2"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.4.9",
    "range_converted": true,
    "vulnerable_version_range": "< 2.4.9"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/paymail"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.4.9"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "0.3.2",
    "range_converted": true,
    "vulnerable_version_range": "< 0.3.2"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/402-pay"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "0.3.2"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "0.1.5",
    "range_converted": true,
    "vulnerable_version_range": "< 0.1.5"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/auth"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "0.1.5"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.2.5",
    "range_converted": true,
    "vulnerable_version_range": "< 2.2.5"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/auth-express-middleware"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.2.5"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.1.7",
    "range_converted": true,
    "vulnerable_version_range": "< 2.1.7"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/payment-express-middleware"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.1.7"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "0.1.2",
    "range_converted": true,
    "vulnerable_version_range": "< 0.1.2"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/chirp"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "0.1.2"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "1.1.6",
    "range_converted": true,
    "vulnerable_version_range": "< 1.1.6"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/teranode-listener"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "1.1.6"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "1.3.7",
    "range_converted": true,
    "vulnerable_version_range": "< 1.3.7"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/gasp"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "1.3.7"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.6.1",
    "range_converted": true,
    "vulnerable_version_range": "< 2.6.1"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/overlay"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.6.1"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.2.5",
    "range_converted": true,
    "vulnerable_version_range": "< 2.2.5"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/overlay-discovery-services"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.2.5"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.7.2",
    "range_converted": true,
    "vulnerable_version_range": "< 2.7.2"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/overlay-express"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.7.2"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "1.8.4",
    "range_converted": true,
    "vulnerable_version_range": "< 1.8.4"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/overlay-topics"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "1.8.4"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.8.0",
    "range_converted": true,
    "vulnerable_version_range": "< 2.8.0"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/sdk"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.8.0"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "0.3.6",
    "range_converted": true,
    "vulnerable_version_range": "< 0.3.6"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/verifast"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "0.3.6"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "1.2.3",
    "range_converted": true,
    "vulnerable_version_range": "< 1.2.3"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/btms"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "1.2.3"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "1.2.1",
    "range_converted": true,
    "vulnerable_version_range": "< 1.2.1"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/btms-permission-module"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "1.2.1"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "0.1.1",
    "range_converted": true,
    "vulnerable_version_range": "< 0.1.1"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/ecpm-permission-module"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "0.1.1"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "0.5.1",
    "range_converted": true,
    "vulnerable_version_range": "< 0.5.1"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/wallet-relay"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "0.5.1"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.13.2",
    "range_converted": true,
    "vulnerable_version_range": "< 2.13.2"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/wallet-toolbox"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.13.2"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.13.2",
    "range_converted": true,
    "vulnerable_version_range": "< 2.13.2"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/wallet-toolbox-client"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.13.2"
      }
     ],
     "type": "SEMVER"
    }
   ]
  },
  {
   "database_specific": {
    "name_valid": true,
    "patched_versions": "2.13.2",
    "range_converted": true,
    "vulnerable_version_range": "< 2.13.2"
   },
   "package": {
    "ecosystem": "npm",
    "name": "@bsv/wallet-toolbox-mobile"
   },
   "ranges": [
    {
     "events": [
      {
       "introduced": "0"
      },
      {
       "fixed": "2.13.2"
      }
     ],
     "type": "SEMVER"
    }
   ]
  }
 ],
 "aliases": [],
 "database_specific": {
  "attribution": "Advisory metadata from published GitHub repository security advisories and the GitHub Advisory Database (https://github.com/advisories, CC BY 4.0); CVE state from CVE Services; OSV.dev; NVD API (this product uses the NVD API but is not endorsed or certified by the NVD). Compiled by Limbowatch (https://limbo.watch), CC BY 4.0.",
  "limbowatch": {
   "cited_cve": null,
   "cited_cve_state": null,
   "cve": "no CVE anywhere",
   "cwe_ids": [
    "CWE-20",
    "CWE-347",
    "CWE-400",
    "CWE-89",
    "CWE-918"
   ],
   "first_seen_by_limbowatch": "2026-10-28T07:18:42Z",
   "in_osv": false,
   "likely_permanent": false,
   "nvd_status": null,
   "quality": {
    "names": "ok",
    "ranges": "converted"
   },
   "repository": "bsv-blockchain/ts-stack",
   "reviewed": false,
   "severity": "high",
   "status": "in limbo",
   "uncited_cves": []
  }
 },
 "id": "GHSA-qp3j-h5xf-p2p7",
 "modified": "2026-11-12T20:26:11Z",
 "published": "2026-09-23T09:19:30Z",
 "references": [
  {
   "type": "ADVISORY",
   "url": "https://github.com/bsv-blockchain/ts-stack/security/advisories/GHSA-qp3j-h5xf-p2p7"
  }
 ],
 "schema_version": "1.6.0",
 "severity": [
  {
   "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
   "type": "CVSS_V3"
  }
 ]
}