@nocobase/devtools (>=1.9.0 <=1.9.22), @nocobase/server (>=1.9.0 <=1.9.22) +1 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=1.9.0 <=1.9.22)

@nocobase/auth NPM version =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.22 Source cves: CVE-2025-13877 Source advisory: OSV:GHSA-MV7P-34FV-4874...

@nocobase/devtools (>=1.9.0 <=1.9.21), @nocobase/server (>=1.9.0 <=1.9.21) +1 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=1.9.0 <=1.9.21)

@nocobase/auth NPM version =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.21 Source cves: CVE-2025-13877 Source advisory: SNYK:JS-NOCOBASEAUTH-14287473...

@nocobase/app (>=1.0.0-alpha.1 <=1.4.0-alpha.20240914095808), @nocobase/cli (>=1.0.0-alpha.1 <=1.4.0-alpha.20240914095808) +3 more potentially affected by CVE-2025-13877 via @nocobase/auth (>=1.0.0-alpha.1 <=1.9.0-beta.17)

@nocobase/auth NPM version =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.9.0-beta.17 Source cves: CVE-2025-13877 Source advisory: SNYK:JS-NOCOBASEAUTH-14287473...

Improper Protection for Out of Bounds Signal Level Alerts

Overview @nocobase/auth is a Affected versions of this package are vulnerable to Improper Protection for Out of Bounds Signal Level Alerts via the official one-click Docker deployment configuration, a public default JWT key was historically provided.. An attacker can gain unauthorized access to...