pig npm Package Authentication Bypass Vulnerability: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- pig (npm)
- Affected versions
- >= v4.0.0, <= v4.0.0
- Patched version
- 4.1.0
An authentication bypass vulnerability has been reported in the pig npm package before version 4.1.0. This vulnerability allows remote attackers to overwrite any account credential.
What happened
The pig npm package before version 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint. This vulnerability allows remote attackers to overwrite any account credential, including the admin account, by submitting a username with an incorrect current password. The vulnerability is tracked as CVE-2026-91995 with a CVSS score of 9.1.
The vulnerability is not yet confirmed to be exploited in the wild. However, due to its severity, it is recommended to take immediate action to mitigate potential risks. The affected version range is from 4.0.0 to 4.0.0 inclusive.
What to do about it
- Upgrade to pig version 4.1.0 or later.
- Review any affected accounts for unauthorized access.
- Monitor the primary sources for updates on the vulnerability.
How 0Day would have caught this
pig is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using pig npm package version 4.0.0.
What should I do right now?
Upgrade to pig version 4.1.0 or later and review any affected accounts for unauthorized access.
Is this vulnerability confirmed?
No, this is an early warning and the vulnerability is under investigation.
Where can I find more information?
Consult the primary sources: CVE-2026-91995 and CVE-2026-92716.