Unmaintained Package Alert: stack-graphs Vulnerability
Summary
RUSTSEC-2026-0303: stack-graphs is archived and unmaintained. Affects stack-graphs versions >= 0.0.0-0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'stack-graphs' package is a Rust library designed for visualizing stack traces in a graphical format. It aids developers in understanding the flow of their applications by providing insights into function calls and execution paths. However, the package has been archived and is no longer maintained, raising concerns about its ongoing security and compatibility with newer Rust versions.
Vulnerability Detail
The vulnerability stems from the fact that the 'stack-graphs' package has been archived on GitHub, meaning it is no longer actively maintained or updated. The last release was version 0.14.1 on December 13, 2024, and the last activity in the repository was on September 9, 2025. This lack of maintenance poses risks as any security vulnerabilities or bugs discovered in the future will not be addressed, potentially exposing applications that rely on this package to security threats.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch or successor for the 'stack-graphs' package, the best workaround is to avoid using it altogether. Consider using other libraries that offer similar stack visualization features but are actively maintained.
Conclusion
The 'stack-graphs' package is no longer maintained, which poses significant risks to applications that rely on it. It is crucial to remove this package and replace it with an actively maintained alternative to ensure the security and stability of your projects.
See every vulnerability recorded for stack-graphs →
FAQ
Archiving a repository means that it is no longer maintained, and no further updates, bug fixes, or support will be provided.
You can search for Rust libraries on crates.io that offer stack visualization features and check their maintenance status and community support.
Using unmaintained packages can expose your application to security vulnerabilities, compatibility issues with newer versions of dependencies, and lack of support for bug fixes.
You can use tools like Vulert, which monitors your Cargo.lock file to alert you in real-time for open-source vulnerabilities. You can check your application against known vulnerabilities using the Vulert playground without any signup.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by the 'stack-graphs' vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for stack-graphs.
