All passport CVEs — Complete Vulnerability History

Last updated: April 1, 2026 · Data: OSV Database

passport is the most widely-used Node.js authentication middleware. Its CVEs are session-related — fixation and state management issues that can lead to authentication bypass.

Full CVE history

Current safe version: 0.6.0

# Before

"passport": "0.5.2"

# After

"passport": "0.6.0"

Then run: npm install

passport CVEs and safe versions

passport is the most widely used Node.js authentication middleware. Its CVEs are typically in the core passport package or specific strategy packages (passport-local, passport-jwt etc.).

Known passport CVEs

Fix passport

# Update passport core
npm install passport@latest

# Safe version — 0.7.0 or later
npm install passport@0.7.0

# Check strategy packages too
npm list passport passport-local passport-jwt

CVE-2022-25896 — session fixation

This is the most critical passport CVE. In passport below 0.6.0, if the user object is modified after login, the wrong user's session data can be returned on subsequent requests. This can lead to authentication bypass. Fix by updating to passport 0.6.0+ and explicitly calling req.session.regenerate() after login.

// After successful authentication, regenerate session
app.post('/login', passport.authenticate('local'), (req, res) => {
  req.session.regenerate((err) => {
    if (err) return next(err);
    req.session.user = req.user;
    res.redirect('/dashboard');
  });
});