openssl_encrypt npm Package Vulnerability: Critical CVE-2026-81700
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- openssl_encrypt (npm)
- Affected versions
- >= v1.4.7, <= v1.4.7 or >= v1.4.6, <= v1.4.6 or >= v1.4.5, <= v1.4.5 or >= v1.4.4, <= v1.4.4 or >= v1.4.2, <= v1.4.2 or >= v1.4.1rc2, <= v1.4.1rc2 or >= v1.4.1rc1, <= v1.4.1rc1 or >= v1.4.0, <= v1.4.0
- Patched version
- 1.4.9
A critical vulnerability in the openssl_encrypt npm package allows attackers to bypass signature verification. Users of affected versions are at risk of executing malicious plugins.
What happened
The openssl_encrypt npm package versions before 1.4.9 contain a signature verification vulnerability. This flaw enables attackers to use revoked or expired keys to bypass signature verification, potentially leading to the execution of malicious plugins. The vulnerability was first flagged on 2026-08-27T17:21:00.367000+00:00 and confirmed shortly after. The affected versions include all releases from 1.4.7 down to 1.4.0 and pre-releases from 1.4.1rc2 down to 1.4.1rc1.
To assess your exposure, check your project dependencies for any versions of openssl_encrypt within the affected range. If you are using a version before 1.4.9, you are vulnerable and should take immediate action to upgrade.
What to do about it
- Upgrade to openssl_encrypt@1.4.9 or later to mitigate the risk.
- Review your project dependencies and ensure all instances of openssl_encrypt are updated to a secure version.
- Monitor the primary sources for any updates or additional patches that may be released.
How 0Day would have caught this
openssl_encrypt is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using openssl_encrypt npm package versions before 1.4.9.
What should I do right now?
Upgrade to openssl_encrypt@1.4.9 or later to mitigate the risk.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild according to the provided data.