altair-express-middleware

npm1 known CVE affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting altair-express-middlewarepage 1 of 1

CVE-2026-110802MEDIUMCVSS 6.1EG 6.1fixed in 8.5.8
2026-11-05
Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in …

Check whether altair-express-middleware is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for altair-express-middleware CVEs against the assets you own.

Book a Demo →