@backstage/plugin-proxy-backend vulnerabilities
CVEs whose affected-version data names the @backstage/plugin-proxy-backend package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-106491Medium· 6.4Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request …
▾ Sunlitbackstage · @backstage/plugin-proxy-backendEPSS 0.27%via NVD
CVE-2026-106456Medium· 4.8Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configur…
▾ Sunlitbackstage · @backstage/plugin-proxy-backendEPSS 0.24%via NVD