ROOT-APP-NPM-CVE-2026-24046 CVE-2026-24046 in @rootio/backstage__backend-defaults - Patched by Root

Root has patched CVE-2026-24046 in the @rootio/backstagebackend-defaults package for Root:npm. Multiple fixed versions available...

Server-side Request Forgery (SSRF)

Overview @backstage/backend-defaults is a Backend defaults used by Backstage backend apps Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the FetchUrlReader component that automatically follows HTTP redirects. An attacker can access internal or sensitive...