NPM · JULY 2026 · EARLY WARNING

Critical Vulnerability in openmemory/api (CVE-2026-59705)

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
CVE-2026-59705Severity: CRITICAL

An unauthenticated access vulnerability has been reported in the openmemory/api component, allowing attackers to manipulate user memories and cause denial-of-service.

What happened

An early warning has been issued regarding a critical vulnerability (CVE-2026-59705) in the openmemory/api component of the mem0 package. This vulnerability reportedly allows unauthenticated attackers to read, write, and delete arbitrary user memories by exploiting API endpoints that lack authentication middleware. Attackers can also cause a denial-of-service condition across all users by invoking specific endpoints. The vulnerability affects a wide range of versions, from v0.0.23 to v2.0.4 and various TypeScript and CLI versions. It is recommended to upgrade to a patched version as soon as it becomes available and to review access controls for API endpoints. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. For more details, consult the primary sources.

How 0Day mitigates this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If openmemory/api is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Join the 0Day waitlist →

← Back to all threats