core-moos npm Package Vulnerability: Critical Authentication Flaw
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- core-moos (npm)
- Affected versions
- >= v10.4.0, <= v10.4.0 or >= v10.0.4-alpha, <= v10.0.4-alpha or >= 10.0.3-devel-candidate, <= 10.0.3-devel-candidate or >= 10.0.2-devel, <= 10.0.2-devel or >= 10.0.1-devel, <= 10.0.1-devel or >= PreProfilingmerge, <= PreProfilingmerge or >= IvPCompatibility, <= IvPCompatibility
- Patched version
- Not yet available
The core-moos npm package through version 10.4.0 has a critical vulnerability. It allows unauthenticated clients to connect with full privileges.
What happened
The core-moos npm package through version 10.4.0 lacks authentication in the wire protocol. This allows unauthenticated clients to connect with full privileges. Attackers can execute privileged operations including clearing all variables and client mail queues. The vulnerability has been confirmed by multiple independent sources and is tracked as CVE-2026-85424.
Affected versions include all releases from 10.0.1-devel to 10.4.0 as well as specific alpha and development candidate versions. The vulnerability was first flagged on 2026-09-03 and confirmed on 2026-09-04.
What to do about it
- Upgrade to a version of core-moos that includes authentication in the wire protocol.
- Rotate any secrets in affected environments.
- Monitor the primary sources for updates on patched versions.
How 0Day would have caught this
core-moos is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using core-moos npm package version 10.4.0 or any version from 10.0.1-devel to 10.4.0 including specific alpha and development candidate versions.
What should I do right now?
Upgrade to a version of core-moos that includes authentication in the wire protocol and rotate any secrets in affected environments.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.