OpnForm npm Package Vulnerability: Critical CVE-2026-75106
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- cve-2026-75106 (npm)
- Affected versions
- >= v2.0.1, <= v2.0.1 or >= v2.0.0, <= v2.0.0 or >= v1.13.2, <= v1.13.2 or >= v1.13.1, <= v1.13.1 or >= v1.13.0, <= v1.13.0 or >= v1.12.1, <= v1.12.1 or >= v1.12.0, <= v1.12.0 or >= v1.11.1, <= v1.11.1 or >= v1.11.0, <= v1.11.0 or >= v1.10.2, <= v1.10.2 or >= v1.10.1, <= v1.10.1 or >= v1.10.0, <= v1.10.0 or >= v1.9.7, <= v1.9.7 or >= v1.9.6, <= v1.9.6 or >= v1.9.5, <= v1.9.5 or >= v1.9.3, <= v1.9.3 or >= v1.9.2, <= v1.9.2 or >= v1.9.1, <= v1.9.1 or >= v1.9.0, <= v1.9.0 or >= v1.8.0, <= v1.8.0 or >= v1.7.3, <= v1.7.3 or >= v1.7.1, <= v1.7.1 or >= v1.7.0, <= v1.7.0 or >= v1.6.6, <= v1.6.6 or >= v1.6.5, <= v1.6.5 or >= v1.6.4, <= v1.6.4 or >= v1.6.3, <= v1.6.3 or >= v1.6.2, <= v1.6.2 or >= v1.6.1, <= v1.6.1 or >= v1.6, <= v1.6 or >= v1.5, <= v1.5 or >= v1.4.5, <= v1.4.5 or >= v1.4.4, <= v1.4.4 or >= v1.4.3, <= v1.4.3 or >= v1.4.2, <= v1.4.2 or >= v1.4.1, <= v1.4.1 or >= v1.4.0, <= v1.4.0 or >= v1.3.7, <= v1.3.7 or >= v1.3.6, <= v1.3.6 or >= v1.3.5, <= v1.3.5 or >= v1.3.4, <= v1.3.4 or >= v1.3.3, <= v1.3.3 or >= v1.3.2, <= v1.3.2 or >= v1.3.0, <= v1.3.0 or >= 1.3.0, <= 1.3.0 or >= v1.2.6, <= v1.2.6 or >= v1.2.5, <= v1.2.5 or >= v1.2.4, <= v1.2.4 or >= v1.2.3, <= v1.2.3 or >= v1.2.2, <= v1.2.2 or >= v1.2.1, <= v1.2.1 or >= v1.1.4, <= v1.1.4 or >= v1.1.3, <= v1.1.3 or >= v1.1.2, <= v1.1.2 or >= v1.1.1, <= v1.1.1 or >= v1.0.1, <= v1.0.1
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the OpnForm npm package. The vulnerability, tracked as CVE-2026-75106, allows unauthenticated attackers to access and modify submission data.
What happened
The OpnForm npm package reportedly derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt. This design flaw allows unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.
The vulnerability affects all versions of OpnForm from v1.0.1 to v2.0.1 inclusive. The issue is under investigation and no patched version has been released yet.
What to do about it
- Monitor the primary sources for updates on a patched version.
- If you are using OpnForm, assume that submission secrets may have been compromised.
- Rotate any secrets that may have been exposed.
- Consider implementing additional access controls or authentication mechanisms to protect submission data until a patch is available.
- Consult the primary sources for the most current information and recommendations.
How 0Day would have caught this
cve-2026-75106 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using OpnForm npm package versions from v1.0.1 to v2.0.1 inclusive.
What should I do right now?
Monitor the primary sources for updates on a patched version. Rotate any secrets that may have been exposed. Consider implementing additional access controls or authentication mechanisms to protect submission data until a patch is available.
Is there a patched version available?
No official fix has been published yet. Monitor the sources for updates.
How severe is this vulnerability?
The vulnerability is classified as CRITICAL with a CVSS score of 9.1.