NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
MEDIUM severity

CVE-2026-25957 — @cubejs-backend/server-co…

MEDIUM

CVE-2026-25957 is a medium-severity (CVSS 6.5) CWE-755 vulnerability in @cubejs-backend/server-core. A fix is available for @cubejs-backend/server-core — see the affected versions and patch details below.

Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request

Also known asGHSA-9vph-2hvm-x66g
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-25957.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk-0.01%
Lower risk than most CVEs38th percentile — riskier than 38% of all scored CVEsHighest risk
0.00%0.32%0.63%0.95%0.0%0.4%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

7other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@cubejs-backend/server-corenpm
91Kdownloads / week

Description

Impact

It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.

Affected Versions:

>= 1.1.17

Mitigation:

Upgrade to a patched version:

  • 1.5.13 and later (regular release)
  • 1.4.2 (active LTS release)

References

The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npm@cubejs-backend/server-core≥ 1.1.17&&< 1.4.21.4.2npm install @cubejs-backend/server-core@1.4.2
📦npm@cubejs-backend/server-core≥ 1.5.0&&< 1.5.131.5.13npm install @cubejs-backend/server-core@1.5.13

Affected Products

1 product · 2 configurations
Application
cube.jscube
≥ 1.5.0 && < 1.5.13
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @cubejs-backend/server-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update @cubejs-backend/server-core to 1.4.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-25957 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### **Impact** It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. ### Affected Versions: `>= 1.1.17` ### Mitigation: Upgrade to a patched version: - 1.5.13 and later (regular release) - 1.4.2 (active [LTS release](https://cube.dev/docs/product/administration/distribution#long-term-support)) ### **References** The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.
O3 Security · Impact-Aware SCA

Is CVE-2026-25957 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-25957: @cubejs-backend/server — Fixed in 1.4.2