What’s Vulnerable › Products

centrifugal centrifugo vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your centrifugal centrifugo version is affected

Latest centrifugal centrifugo vulnerabilities

• CVE-2026-71485 — Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends (CVSS 9.1)
• CVE-2026-62963 — Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport (CVSS 8.7)
• CVE-2026-49998 — Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass (CVSS 8.2)
• CVE-2026-32301 — Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL (CVSS 9.3)