CLEANSTART-2026-BG95605 Security fixes in langfuse-worker 4.0.0-r1

🗓️ 01 Sep 2026 11:17:16Reported by GoogleType

osv🔗 osv.dev👁 2 Views

langfuse-worker 4.0.0-r1 fixes 24 vulnerabilities including GHSA and CVE entries.

Reporter	Title	Published	Views	Family All 1037
Vulnrichment	CVE-2026-16729 undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields	29 Jul 202616:45	–	vulnrichment
Vulnrichment	CVE-2026-18446 fast-uri vulnerable to host confusion via backslash authority introducer	31 Jul 202614:37	–	vulnrichment
Vulnrichment	CVE-2026-50159 Mermaid allows CSS injection applying to sibling elements of the diagram	6 Aug 202619:55	–	vulnrichment
Vulnrichment	CVE-2026-54272 ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks	27 Jul 202617:13	–	vulnrichment
Vulnrichment	CVE-2026-67213 nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom	29 Jul 202613:32	–	vulnrichment
Vulnrichment	CVE-2026-67214 nanoid Infinite Loop via Negative Size in non-secure module	29 Jul 202613:32	–	vulnrichment
Vulnrichment	CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset	3 Aug 202616:56	–	vulnrichment
Vulnrichment	CVE-2026-69192 ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass	3 Aug 202619:56	–	vulnrichment
Vulnrichment	CVE-2026-69198 ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks	3 Aug 202619:59	–	vulnrichment
Vulnrichment	CVE-2026-71436 Mermaid XY Charts are vulnerable to an infinite loop DoS	6 Aug 202619:49	–	vulnrichment

Source	Link
github	www.github.com/langfuse/langfuse

02 Sep 2026 07:11Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5 - 9.1

CVSS 48.2

EPSS0.00609

SSVC

langfuse-worker security fixes multiple vulnerabilities library