← All advisories

Critical severity9.8NVD Advisory· Published Jan 4, 2022· Updated Jun 17, 2026

CVE-2022-0086

CVE-2022-0086

Description

uppy is vulnerable to Server-Side Request Forgery (SSRF)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@uppy/companionnpm	< 3.1.5	3.1.5

Affected products

3

Transloadit/Uppy
cpe:2.3:a:transloadit:uppy:*:*:*:*:*:node.js:*:*
Range: <2.3.3
ghsa-coords
pkg:npm/%40uppy/companion
Range: < 3.1.5
transloadit/transloadit/uppyv5
Range: unspecified

Patches

Vulnerability mechanics

References

6

github.com/transloadit/uppy/commit/fc137e30a2a3102eb191141f280d5de20dacdf8fnvdPatchThird Party AdvisoryWEB
huntr.dev/bounties/c1c03ef6-3f18-4976-a9ad-08c251279122nvdExploitPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-x8rq-rc7x-5fg5ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-0086ghsaADVISORY
github.com/transloadit/uppy/pull/3403ghsaWEB
github.com/transloadit/uppy/releases/tag/uppy%402.3.3ghsaWEB

News mentions

0

No linked articles in our index yet.