GHSA-4j6x-w426-6rc6
Default Express middleware security check is ignored in production
GHSA-4j6x-w426-6rc6 is a vulnerability with no CVSS score yet in @cubejs-backend/api-gateway, published November 8, 2019. No source lists public exploit code. Fixed in @cubejs-backend/api-gateway 0.11.17.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.11.17@cubejs-backend/api-gateway +1 more
Description
Default Express middleware security check is ignored in production
Impact
All Cube.js deployments that use affected versions of @cubejs-backend/api-gateway with default express authentication middleware in production environment are affected.
Patches
@cubejs-backend/api-gateway@0.11.17
Workarounds
Override default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/cube-js/cube.js/issues
- Reach out us in community Slack: https://slack.cube.dev/
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@cubejs-backend/api-gatewaynpm | 0.11.0 to 0.11.16 | 0.11.17 |
@cubejs-backend/api-gatewaynpm | 0.11.0 up to 0.11.17 | 0.11.17 |
What each source reports
GitHub AdvisoriesNo score
Default Express middleware security check is ignored in production
Default Express middleware security check is ignored in production
Impact
All Cube.js deployments that use affected versions of @cubejs-backend/api-gateway with default express authentication middleware in production environment are affected.
Patches
@cubejs-backend/api-gateway@0.11.17
Workarounds
Override default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/cube-js/cube.js/issues
- Reach out us in community Slack: https://slack.cube.dev/
- Record
GHSA-4j6x-w426-6rc6- Updated
- 2026-11-02
OSVNo score
Default Express middleware security check is ignored in production
Default Express middleware security check is ignored in production
Impact
All Cube.js deployments that use affected versions of @cubejs-backend/api-gateway with default express authentication middleware in production environment are affected.
Patches
@cubejs-backend/api-gateway@0.11.17
Workarounds
Override default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/cube-js/cube.js/issues
- Reach out us in community Slack: https://slack.cube.dev/
- Record
GHSA-4j6x-w426-6rc6- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.