---
id: CVE-2026-61782
title: Rsdoctor is a build analyzer tailored for projects built with Rspack
summary: >-
  Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to
  version 1.5.16, the default Rsdoctor report HTTP server started by
  `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and
  serves a `POST /a…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
vendor: web-infra-dev
product: rsdoctor
affected:
  - rsdoctor < 1.5.16
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T18:17:16.333'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61782'
references:
  - url: >-
      https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61782'
  - url: 'https://github.com/web-infra-dev/rsdoctor/pull/1744'
  - url: 'https://github.com/web-infra-dev/rsdoctor/pull/1758'
  - url: >-
      https://github.com/web-infra-dev/rsdoctor/commit/602eb306a49b6d19c4c1ea9d8ee0f8caab9e208f
  - url: >-
      https://github.com/web-infra-dev/rsdoctor/commit/e9aaef21f85becfe43a46f716509f41ea5edeb40
  - url: 'https://github.com/advisories/GHSA-jmg2-rcxh-w8q3'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
ingestedAt: '2026-09-24T17:48:30.404Z'
aliases:
  - GHSA-jmg2-rcxh-w8q3
ecosystem: npm
patched:
  - '@rsdoctor/rspack-plugin 1.5.16'
---

## Overview

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /api/data/key` endpoint with no authentication and wildcard CORS (`Access-Control-Allow-Origin: *`). Any network-adjacent or remote attacker can send a single unauthenticated request to retrieve the full source code of all compiled JavaScript modules (`moduleCodeMap`), serialized build configuration (`configs`), error details, and other sensitive build metadata. This server is enabled by default in non-CI environments, requiring no special configuration from the victim developer. Version 1.5.16 patches the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61782)

Affected packages:

- `@rsdoctor/rspack-plugin <= 1.5.15`

Patched in:

- `@rsdoctor/rspack-plugin 1.5.16`

Source: https://github.com/advisories/GHSA-jmg2-rcxh-w8q3