tidewave vulnerabilities

CVEs whose affected-version data names the tidewave package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-109823Low· 2.3

yesterday

Host filesystem path disclosure via DNS rebinding

An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain …

▾ Sunlittidewave-ai · tidewavevia CVEORG