npm nango vulnerabilities

Latest npm nango CVEs

Newest publication first

1. CVE-2026-92804 Nango through 0.70.4 Server-Side Request Forgery via Configuration

   Published 2026-09-16

   High·CVSS 7.1 EPSS 0.37%

   Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata end...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.