@sigstore/oci vulnerabilities (npm)

2 vulnerabilities.

• @sigstore/oci npm @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location CVE-2026-118763 Fix available 7.4 HighOctober 29, 2026
• @sigstore/oci npm Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry CVE-2026-59891 Public exploitFix available 9.6 CriticalJuly 14, 2026