Vaadin and the October 2026 Node.js security releases

A deployed Vaadin application does not run Node.js, so it is not exposed to the vulnerabilities fixed in the Node.js security releases of 21 October 2026. Vaadin uses Node.js only to build the frontend and to run development mode, which means the exposure, where there is any, is in build and...

No version of Vaadin uses PHP

No version of Vaadin uses PHP. No Vaadin product contains PHP code, and no PHP interpreter takes part in building, running or deploying a Vaadin application. Vaadin is therefore not affected by CVE-2026-109618 or CVE-2026-109619, and no Vaadin release is needed in response to them.This page exist...

CVE-2026-110803

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

CVE-2026-107588

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are...

CVE-2026-110803

The Vaadin Framework 8 (specifically com.vaadin:vaadin-server versions 8.16.0 - 8.32.1 and com.vaadin:vaadin-server-mpr-jakarta versions 8.18.0 - 8.32.1 ) is vulnerable to a session lock leak leading to a Denial of Service (DoS) . The root cause is in VaadinService.requestEnd(), where the applica...

CVE-2026-110803 Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

CVE-2026-107588

The Vaadin Charts library (specifically the bundled Highcharts library) is vulnerable to multiple issues including Prototype Pollution and Cross-Site Scripting (XSS) . The root cause is that Vaadin pins specific Highcharts versions (9.2.2 for Vaadin 22-24; 12.2.0 for Vaadin 25), preventing indepe...

CVE-2026-107588 Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are...

com.vaadin:vaadin (>=25.2.0-beta1, <=25.2.6), com.vaadin:vaadin-ee (>=25.2.2, <=25.2.6) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.2.0-beta1, <=25.2.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.2.0-beta1, =25.2.0-beta1, =25.2.2, =25.2.6 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=24.7.0, <=24.9.21) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.7.0, <=24.9.21)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.7.0, =24.7.0, =24.9.21 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

com.vaadin:vaadin (>=24.10.0-beta1, <=24.10.9) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.10.0-beta1, <=24.10.9)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.10.0-beta1, =24.10.0-beta1, =24.10.9 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in SpreadsheetHandlerImpl.updateCellComment, which writes the supplied text to the target cell without checking whether the active sheet is protected or the cell locked, unlike the edit, cut, and paste handlers i...

com.vaadin:vaadin (>=25.0.0-beta1, <=25.1.11) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.0.0-beta1, <=25.1.11)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.0.0-beta1, =25.0.0-beta1, =25.1.11 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

CVE-2026-93547

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-91860

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

com.vaadin:vaadin (>=24.10.0, <=24.10.9) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=24.10.0, <=24.10.9)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...