Skip to content

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

An open source headless CMS solution to create and manage your own API. It provides a powerful dashboard and features to make your life easier. Databases supported: MongoDB, MySQL, MariaDB, PostgreSQL, SQLite

Latest release3.6.11
Declared licenseSEE LICENSE IN LICENSE
Listed maintainerslauriejim, pierreburgy, aurelsicoko, alexandrebodin, petersg83, convly, hichamelbsi
Runtime dependencies53
Install-time scriptspostinstall
Integrity metadataRecorded by registry
Attestation metadataNot recorded
Registry deprecationStrapi V3 is no longer maintained
Direct dependencies of 3.6.11

Fetched 15/11/2026, 03:38:29 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.3
CVE-2026-57997

Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration

Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

strapi · strapi