essential-moos npm Package Authorization Flaw: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- essential-moos (npm)
- Affected versions
- >= 10.0.1-release, <= 10.0.1-release or >= 10.0.0-release, <= 10.0.0-release
- Patched version
- Not yet available
An early warning has been issued for a critical authorization flaw in the essential-moos npm package versions 10.0.0-release and 10.0.1-release. This flaw allows potential reconfiguration of network routes and listeners at runtime.
What happened
The essential-moos npm package through version 10.0.1 reportedly fails to properly authorize PSHARE_CMD messages. This flaw allows attackers to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages to open new listeners on arbitrary addresses and redirect or duplicate bus traffic to attacker-controlled destinations.
The vulnerability is tracked under CVE-2026-85430 and CVE-2026-85433. The CVSS scores for these vulnerabilities are 9.1 and 9.8 respectively. The issue was first flagged on 2026-09-03T23:17:22.500000+00:00. The affected components are essential-moos (npm) versions >= 10.0.1-release, <= 10.0.1-release or >= 10.0.0-release, <= 10.0.0-release.
What to do about it
- Upgrade to a version of essential-moos that fixes the authorization issue if available.
- Apply a workaround if one is available to mitigate the risk.
- Monitor the primary sources for updates on patched versions.
- Review your network configurations and listener setups for any unauthorized changes.
- Consider implementing additional authorization checks for PSHARE_CMD messages as a temporary measure.
How 0Day would have caught this
essential-moos is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using essential-moos npm package versions 10.0.0-release or 10.0.1-release.
What should I do right now?
Upgrade to a version that fixes the authorization issue or apply a workaround if available. Monitor the primary sources for updates.
Has this been exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time.
Where can I find more information?
Consult the primary sources provided for more detailed information on CVE-2026-85430 and CVE-2026-85433.