Skip to content
Patch Next
Sign inAdd to your agent

← Actionable
Medium, CVSS 6.9amended

Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass

CVE-2026-45577GHSA-5cvp-p7p4-mcx9

What to do

Vendor fix available. Upgrade each affected package to the fixed version on its release line (neotoma 0.11.1), redeploy, then verify what is actually installed.

This page has no inventory attached, so it cannot say whether you are affected. A vendor fix is not proof that your deployment is fixed.

Add to your agent

Affected packages

  • npm neotoma

    Affected
    >= 0.6.0, < 0.11.1
    Fixed in
    0.11.1

Sources

Severity and exploitation
Exploitation
No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.
CVSS 4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N · score source
EPSS
  • CVE-2026-45577: 0.25% estimated exploitation activity in the next 30 days; percentile 16.29 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.
Source description

As published by the source; long descriptions are shortened.

Neotoma versions starting at v0.6.0 can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In affected deployments, the REST auth middleware can resolve unauthenticated requests as the local development user, making the hosted Inspector and related API surface reachable without credentials. Impact: unauthorized access to production data exposed through the Inspector/API on affected deployments. Affected condition: a public deployment behind a reverse proxy or same-host tunnel that forwards traffic to the Node process over loopback. Remediation implemented on the main branch: local-request detection now fails closed in production unless loopback trust is explicitly enabled, and forwarded public clients remain remote. Patched release version is pending; this draft will be updated once the fix is released.

Dates and revisions
Published by the source
Last modified by the source
Source last checked
  1. Revision 3 · amended ·

    Amended from ghsa record GHSA-5cvp-p7p4-mcx9

  2. Revision 2 · amended ·

    Reviewed OSV alias/range/CVSS4 correction; package source scopes and original publication preserved. No customer finding resolved.

  3. Revision 1 · created ·

    Published from osv record GHSA-5cvp-p7p4-mcx9

Agent brief

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-45577

Advisory: Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass
IDs: CVE-2026-45577, GHSA-5cvp-p7p4-mcx9
Record: https://patchnext.com/advisories/cve-2026-45577 (revision 3, source checked 26 Oct 2026, 12:53 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.9)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: neotoma 0.11.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm neotoma: affected >= 0.6.0, < 0.11.1; fixed in 0.11.1

## Suggested inspection (read-only)
- `npm ls neotoma --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on neotoma.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-5cvp-p7p4-mcx9 (OSV record GHSA-5cvp-p7p4-mcx9 lists affected ranges: npm neotoma >=0.6.0 <0.11.1 (fixed))
- Verified: https://github.com/advisories/GHSA-5cvp-p7p4-mcx9 (GitHub-reviewed advisory GHSA-5cvp-p7p4-mcx9 lists affected ranges: npm neotoma >=0.6.0 <0.11.1)

Commands are suggestions: review each one before running it.

Loading voting…