CLEANSTART-2026-YR55628 Security fixes in langfuse-worker 3.194.1-r1

🗓️ 01 Sep 2026 11:17:16Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Security fixes in langfuse-worker 3.194.1-r1 addressing 30 vulnerabilities including CVE-2026-50272.

Reporter	Title	Published	Views	Family All 1030
Vulnrichment	CVE-2026-67214 nanoid Infinite Loop via Negative Size in non-secure module	29 Jul 202613:32	–	vulnrichment
Vulnrichment	CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset	3 Aug 202616:56	–	vulnrichment
Vulnrichment	CVE-2026-69192 ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass	3 Aug 202619:56	–	vulnrichment
Vulnrichment	CVE-2026-69198 ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks	3 Aug 202619:59	–	vulnrichment
Vulnrichment	CVE-2026-71436 Mermaid XY Charts are vulnerable to an infinite loop DoS	6 Aug 202619:49	–	vulnrichment
Vulnrichment	CVE-2026-71437 Mermaid Architecture diagrams are vulnerable to prototype pollution	6 Aug 202619:51	–	vulnrichment
Vulnrichment	CVE-2026-71438 Mermaid configuration APIs allow prototype pollution	6 Aug 202619:59	–	vulnrichment
Vulnrichment	CVE-2026-71439 Mermaid radar diagrams are vulnerable to DoS	6 Aug 202620:01	–	vulnrichment
Vulnrichment	CVE-2026-73418 NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers	12 Aug 202620:21	–	vulnrichment
Vulnrichment	CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass	13 Aug 202622:04	–	vulnrichment

Source	Link
github	www.github.com/langfuse/langfuse

04 Sep 2026 13:32Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5 - 9.1

CVSS 49.1

EPSS0.00793

SSVC