# CVE-2026-31839: @striae-org/striae — Fixed in 3.0.0

📦

📦 npm

Not in CISA KEV

HIGH severity

# CVE-2026-31839 — @striae-org/striae

HIGH 

CVE-2026-31839 is a high-severity (CVSS 8.2) CWE-354 vulnerability in @striae-org/striae. A fix is available for @striae-org/striae — see the affected versions and patch details below.

Striae has a hash validation utility vulnerability

Also known as[GHSA-mmf8-487q-p45m](/vulnerability/GHSA-mmf8-487q-p45m)

Published

Mar 11, 2026

Updated

Nov 5, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-31839.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.1%probability of exploitation in next 30 days

Lower Risk+0.01%

Lower risk than most CVEs3th percentile — riskier than 3% of all scored CVEsHighest risk

0.00%0.23%0.45%0.68%0.0%0.1%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

1 pkg affected

📦`@striae-org/striae`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.

## Description

### Summary

A high-severity integrity bypass vulnerability existed in Striae's digital confirmation workflow prior to v3.0.0. Hash-only validation trusted manifest hash fields that could be modified together with package content, allowing tampered confirmation packages to pass integrity checks.

### Impact

Confirmation package integrity could be bypassed because both content and hash values were mutable in the same trust boundary. An attacker with access to an exported package could alter confirmation data and recompute hashes so hash-only checks still passed.

This affects users relying on digital confirmations as an immutability and forensic chain-of-custody control.

### Patches

Patched in **v3.0.0**.

Upgrade to:

-   `v3.0.0` or later

Security behavior added in v3.0.0:

-   Server-issued asymmetric signatures for forensic manifests
-   Canonical payload signature verification during import and manual hash verification
-   Fail-closed behavior when signature metadata is missing or invalid
-   Signature/key provenance support for audit-related workflows

### Workarounds

There is no full cryptographic workaround equivalent to upgrading.

Temporary mitigations:

-   Treat hash-only validation as a tamper indicator, not proof of immutability
-   Restrict package exchange to trusted authenticated internal channels
-   Require out-of-band reviewer attestation for sensitive confirmation workflows
-   Pause imports from untrusted sources until upgraded

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

📦npm

`@striae-org/striae` 

≥ 0.9.22-0&&< 3.0.0

3.0.0`npm install @striae-org/striae@3.0.0`

## Affected Products

1 product · 1 configurations

Application

`striae`striae

≥ 0.9.22 && ≤ 3.0.0

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @striae-org/striae, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update @striae-org/striae to 3.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-31839 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
    

## Frequently Asked Questions

\## Summary A high-severity integrity bypass vulnerability existed in Striae's digital confirmation workflow prior to v3.0.0. Hash-only validation trusted manifest hash fields that could be modified together with package content, allowing tampered confirmation packages to pass integrity checks. ## Impact Confirmation package integrity could be bypassed because both content and hash values were mutable in the same trust boundary. An attacker with access to an exported package could alter confirmation data and recompute hashes so hash-only checks still passed. This affects users relying on di

O3 Security · Impact-Aware SCA

### Is CVE-2026-31839 in your dependencies?

Find it across npm, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)