CVE-2026-65843 · Package
NO FIX YET · SEE WHAT TO DO
sync-rpc runs asynchronous commands synchronously by sending them to a separate process over a local port. Prior to 1.3.7, an attacker who could guess that port and reach it (no firewall block) could load and execute arbitrary JavaScript files stored on the server.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that depend on sync-rpc below 1.3.7 and run it on a server where its port can be reached by an attacker. Exposure depends on whether the port is blocked by a firewall; the sources do not say whether the port is otherwise reachable by default.
Not affected if port-firewalled, version-1.3.7-or-later
Who cares node, self-hosted, sync-rpc
npm ls sync-rpcsync-rpc is a direct or transitive dependency in package-lock.json or yarn.locksync-rpc 1.3.7sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.