velocityjs npm Package Vulnerability: What We Know
- Severity
- HIGH
- Affected component
- velocityjs (npm)
- Affected versions
- < 2.1.7 or <= 2.1.5
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the velocityjs npm package. Applications using affected versions are reportedly at risk of remote code execution.
What happened
An early warning has been issued regarding a critical vulnerability in the velocityjs npm package. The vulnerability, tracked as GHSA-7GFH-X38P-PRH3 and GHSA-J658-C2GF-X6PQ, allows for remote code execution via property-read to the Function constructor. This vulnerability bypasses a previous fix, making applications that render untrusted Velocity templates vulnerable to arbitrary code execution on the server. The affected versions are those less than 2.1.7 or less than or equal to 2.1.5.
The vulnerability was first flagged on July 24, 2026. It is currently under investigation and has not been exploited in the wild. However, the severity is high, and immediate action is recommended to mitigate potential risks.
What to do about it
- Identify and list all applications that use the velocityjs npm package.
- Check the version of velocityjs in use. If it is less than 2.1.7 or less than or equal to 2.1.5, you are potentially affected.
- Avoid rendering untrusted Velocity templates in your applications.
- Monitor the primary sources for updates on a patched version. No official fix has been published yet.
- Once a patched version is available, upgrade to it immediately.
How 0Day would have caught this
velocityjs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if your application uses velocityjs npm package version less than 2.1.7 or less than or equal to 2.1.5.
What should I do right now?
Identify if your application uses an affected version of velocityjs. If so, avoid rendering untrusted Velocity templates and monitor the primary sources for updates on a patched version.
When will a fix be available?
No official fix has been published yet. Monitor the primary sources for updates.
How severe is this vulnerability?
The severity of this vulnerability is high due to the potential for remote code execution on the server.