@mastra/server vulnerabilities

CVEs whose affected-version data names the @mastra/server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-82273Medium· 6.5PoC

4w ago

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GE…

▾ Twilightmastra-ai · @mastra/serverEPSS 0.38%via NVD