Shuffle npm Package Vulnerability: Critical CVE-2026-92716 Alert
- Severity
- CRITICAL
- CVSS
- 9.6
- Affected component
- shuffle (npm)
- Affected versions
- >= v2.2.1-nightly, <= v2.2.1-nightly or >= nightly-1771943791, <= nightly-1771943791 or >= nightly-1771869385, <= nightly-1771869385 or >= nightly-04112025, <= nightly-04112025 or >= nightly-04102025, <= nightly-04102025 or >= nightly-01112025, <= nightly-01112025 or >= nightly-31102025-v1, <= nightly-31102025-v1 or >= nightly-31102025, <= nightly-31102025 or >= nightly-23092025-v1, <= nightly-23092025-v1 or >= nightly-23092025, <= nightly-23092025 or >= 2.1.0-nightly-02072026, <= 2.1.0-nightly-02072026 or >= nightly-14122024-2, <= nightly-14122024-2 or >= nightly-14122024-1, <= nightly-14122024-1 or >= nightly-14122024, <= nightly-14122024 or >= v1.4.2, <= v1.4.2 or >= v1.4.1, <= v1.4.1 or >= v1.4.0, <= v1.4.0 or >= v1.3.3, <= v1.3.3 or >= 1.3.1, <= 1.3.1 or >= v1.3.0, <= v1.3.0 or >= 1.1.0, <= 1.1.0 or >= 1.0.0, <= 1.0.0 or >= 0.9.25, <= 0.9.25 or >= 0.9.0, <= 0.9.0 or >= 0.8.0, <= 0.8.0 or >= 0.7.6, <= 0.7.6 or >= 0.7.5, <= 0.7.5 or >= 0.7.1, <= 0.7.1 or >= 0.7.0, <= 0.7.0 or >= 0.6.5, <= 0.6.5 or >= 0.6.0, <= 0.6.0 or >= 0.5.5, <= 0.5.5 or >= 0.5.0, <= 0.5.0
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the Shuffle npm package. Organizations using affected versions may be at risk of cross-tenant privilege escalation.
What happened
An early warning has been issued for a critical vulnerability, tracked as CVE-2026-92716, in the Shuffle npm package. The vulnerability, which has a CVSS score of 9.6, reportedly allows administrators to reset and read API keys of non-administrator users in other organizations. This could enable account takeover across tenant boundaries. The vulnerability is present in the HandleApiGeneration endpoint of Shuffle versions >= v2.2.1-nightly and <= v2.2.1-nightly or other specified nightly versions and older versions as detailed in the affected components list.
The vulnerability was first flagged on September 16, 2026. It is under investigation and has not yet been confirmed as exploited in the wild. The supply-chain attack status is currently marked as no. Organizations using Shuffle should review their API key management practices and assess their exposure to this vulnerability.
What to do about it
- Review your use of the Shuffle npm package and compare it against the affected version ranges provided.
- If you are using an affected version, prepare to upgrade to a fixed version of Shuffle once it becomes available.
- In the interim, review and strengthen your API key management practices to mitigate potential risks.
- Monitor the primary sources for updates on the vulnerability and any released patches.
- No official fix has been published yet. Continue to monitor the sources below for updates.
How 0Day would have caught this
shuffle is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using Shuffle npm package versions >= v2.2.1-nightly and <= v2.2.1-nightly or other specified nightly versions and older versions as detailed in the affected components list.
What should I do right now?
Review your use of the Shuffle npm package and compare it against the affected version ranges provided. Prepare to upgrade to a fixed version of Shuffle once it becomes available and review your API key management practices.
Is there a patch available?
No official fix has been published yet. Continue to monitor the sources below for updates.