VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/navidrome/navidrome: vulnerability history, versions and safety

github.com/navidrome/navidrome is a package in the Go ecosystem. Vulert records 22 vulnerabilities for it across 120 releases, from Jan 2022 to Feb 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
22 vulnerabilities recorded C2 H4 M5 U11
i
2 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
4 in the last 12 months

Most recent disclosure 05 Feb 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/navidrome/navidrome vulnerabilities

Vulert verdict on github.com/navidrome/navidrome v0.64.2 i

Updated on 23 Oct 2026

Careful: v0.64.2 has 18 known vulnerabilities, and 2 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.64.2 — affected i
  • Vulnerabilities on record 22 over 4 years · 4 in the last year i
  • Latest disclosure 05 Feb 2026 i
  • Highest CVSS 9.2 i
  • With no published fix 2 i
  • Stars 24,179 i
  • OpenSSF scorecard 4/10 i
  • Last release this month i
  • Licence GPL-3.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/navidrome/navidrome, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261021122626-56cc32aedea8 21 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261021122626-56cc32aedea8 21 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261018080024-df77c462e85d 18 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261018080024-df77c462e85d 18 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261016215433-a45adbbb2eb5 16 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261016215433-a45adbbb2eb5 16 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261014142326-be201a2d7972 14 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261014142326-be201a2d7972 14 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261012184907-30663f7d4f2f 12 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261012184907-30663f7d4f2f 12 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261011173334-8e306b1f6172 11 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261011173334-8e306b1f6172 11 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261011170515-4ae97ab59e67 11 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261009124555-497dfe25866d 09 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261009124555-497dfe25866d 09 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261008213442-b78c96393156 08 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261008213442-b78c96393156 08 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261006145707-52135913d474 06 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261006145707-52135913d474 06 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261006135011-caa2f8a0c012 06 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261006135011-caa2f8a0c012 06 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261003155854-95f67d2c4ef3 03 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261003155854-95f67d2c4ef3 03 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20261002090532-758e64c9996e 02 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20261002090532-758e64c9996e 02 Oct 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260929172336-0e1893530b84 29 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260929172336-0e1893530b84 29 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260929152114-e03ce871773c 29 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260929152114-e03ce871773c 29 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260929025013-3a31f702b529 29 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260929025013-3a31f702b529 29 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260928220644-a62d1629f0ff 28 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260928220644-a62d1629f0ff 28 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260928124836-612c8290f956 28 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260928124836-612c8290f956 28 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260928120705-ab5869123dad 28 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260928120705-ab5869123dad 28 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260928015658-4cdffd5633e0 28 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260928015658-4cdffd5633e0 28 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260927181824-ce484083bf07 27 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260927181824-ce484083bf07 27 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260927033050-46c432719fdd 27 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260927033050-46c432719fdd 27 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260926192723-c22ce9ebb27c 26 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260926192723-c22ce9ebb27c 26 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260926163052-bb7d81a5ea1b 26 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260926163052-bb7d81a5ea1b 26 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260926154300-4113d954ca0c 26 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260926154300-4113d954ca0c 26 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260925221858-6b05189190a9 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260925221858-6b05189190a9 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260925220610-b293b9625660 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260925220610-b293b9625660 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260925204249-83fff44c822d 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260925204249-83fff44c822d 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260925201930-659d067abaaf 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260925161933-336fa482f84f 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260925161933-336fa482f84f 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260925020717-3f89baaec8f3 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260925020717-3f89baaec8f3 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260925014049-a0c416037655 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.3-0.20260925014049-a0c416037655 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260925012446-69b496383deb 25 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260923224211-101145742f47 23 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.2 23 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.2-0.20260923224211-101145742f47 23 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260923210450-ee6dd1bc0311 23 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.2-0.20260923210450-ee6dd1bc0311 23 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260923161025-27483a46dcda 23 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.2-0.20260923161025-27483a46dcda 23 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260923135435-39028f65c807 23 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.2-0.20260923135435-39028f65c807 23 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260922235132-961ee8c4136f 22 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.2-0.20260922235132-961ee8c4136f 22 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260921232748-9e3deb4330b3 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.2-0.20260921232748-9e3deb4330b3 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260921213432-285dc4f39155 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.1 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260921201838-07c756db3c0a 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.1-0.20260921201838-07c756db3c0a 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260921130612-00bb120288af 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.1-0.20260921130612-00bb120288af 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260921022555-6b3938b5b659 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.1-0.20260921022555-6b3938b5b659 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260921020223-c3b9b4ecb37f 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260921013635-cabfd16f9fae 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.1-0.20260921013635-cabfd16f9fae 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260921011041-9e8811e4c5cf 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.1-0.20260921011041-9e8811e4c5cf 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260921004646-237276efcd1e 21 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260920192720-0429fb3d40ff 20 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.1-0.20260920192720-0429fb3d40ff 20 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260920174014-8b4125267eda 20 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.1-0.20260920174014-8b4125267eda 20 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260920163718-8e784b6af7ba 20 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.1-0.20260920163718-8e784b6af7ba 20 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260920161757-a5334ee46b9c 20 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260920010558-49f626c00a0e 20 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.1-0.20260920010558-49f626c00a0e 20 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.0.0-20260919211049-672c0af580b1 19 Sep 2026 C2 H3 M4 U9 GPL-3.0 No Details →
v0.64.1-0.20260919211049-672c0af580b1 19 Sep 2026 C2 H3 M4 U9 — No Details →
v0.0.0-20260919185701-b76ae1428617 19 Sep 2026 C2 H3 M4 U9 — No Details →
v0.64.1-0.20260919185701-b76ae1428617 19 Sep 2026 C2 H3 M4 U9 — No Details →
v0.0.0-20260919180742-be8ec15168b7 19 Sep 2026 C2 H3 M4 U9 — No Details →
v0.64.1-0.20260919180742-be8ec15168b7 19 Sep 2026 C2 H3 M4 U9 — No Details →
v0.0.0-20260919173319-fed35e08de2d 19 Sep 2026 C2 H3 M4 U9 — No Details →
v0.0.0-20260918034839-16567f147b6a 18 Sep 2026 C2 H3 M4 U9 — No Details →
v0.64.1-0.20260918034839-16567f147b6a 18 Sep 2026 C2 H3 M4 U9 — No Details →
v0.0.0-20260917211756-ded4f47d93d6 17 Sep 2026 C2 H3 M4 U9 — No Details →
v0.64.1-0.20260917211756-ded4f47d93d6 17 Sep 2026 C2 H3 M4 U9 — No Details →
v0.0.0-20260917145928-5bd14da65cd6 17 Sep 2026 C2 H3 M4 U9 — No Details →
v0.64.1-0.20260917145928-5bd14da65cd6 17 Sep 2026 C2 H3 M4 U9 — No Details →
v0.0.0-20260917112956-decac50f6013 17 Sep 2026 C2 H3 M4 U9 — No Details →
v0.64.1-0.20260917112956-decac50f6013 17 Sep 2026 C2 H3 M4 U9 — No Details →
v0.0.0-20260916112832-18205366c8f1 16 Sep 2026 C2 H3 M4 U9 — No Details →
v0.64.1-0.20260916112832-18205366c8f1 16 Sep 2026 C2 H3 M4 U9 — No Details →
v0.0.0-20260915024621-3f4b6a642cf3 15 Sep 2026 C2 H3 M4 U9 — No Details →
v0.64.1-0.20260915024621-3f4b6a642cf3 15 Sep 2026 C2 H3 M4 U9 — No Details →
v0.0.0-20260914005239-dd71f1c57f77 14 Sep 2026 C2 H3 M4 U9 — No Details →
v0.64.1-0.20260914005239-dd71f1c57f77 14 Sep 2026 C2 H3 M4 U9 — No Details →

The newest 120 of 2,467 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 1
  • 2023 1
  • 2024 9
  • 2025 7
  • 2026 4

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 4 of the 22 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/navidrome/navidrome

The 5 most severe of 22 vulnerabilities recorded for this package

Search all 22 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
Denial of Service Vulnerability in Navidrome via Oversized Size Parameter 9.2 critical 0.60.0 04 Feb 2026
CVE-2025-48949: SQL Injection Vulnerability in Navidrome Package 8.9 high 0.56.0 29 May 2025
CVE-2024-47062: Navidrome SQL Injection and ORM Leak Vulnerability 8.8 critical 0.53.0 20 Sep 2024
CVE-2023-51442: Authentication bypass vulnerability in navidrome's subsonic endpoint 8.6 high 0.50.2 19 Dec 2023
CVE-2025-48948: Navidrome Transcoding Permission Bypass Vulnerability 7.4 high 0.56.0 29 May 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/navidrome/navidrome

Is github.com/navidrome/navidrome safe to use?

Vulert records 22 vulnerabilities for github.com/navidrome/navidrome in Go: 2 critical, 4 high, 5 medium and 0 low, plus 11 not yet rated. 2 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/navidrome/navidrome's Vulert package health score?

Vulert scores github.com/navidrome/navidrome 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/navidrome/navidrome affected?

Yes. v0.64.2, the version you would install today, has 18 known vulnerabilities, and 2 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/navidrome/navidrome should I use?

v0.64.2 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/navidrome/navidrome have?

22 vulnerabilities are recorded for github.com/navidrome/navidrome in the Go ecosystem: 2 critical, 4 high, 5 medium and 0 low, plus 11 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/navidrome/navidrome vulnerabilities disclosed?

4 vulnerabilities were recorded for github.com/navidrome/navidrome in the last 12 months, and the oldest entry in this database dates to 27 Jan 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/navidrome/navidrome are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/navidrome/navidrome for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/navidrome/navidrome version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.