VulertSecurity VulertSecurity

Vulnerability Database · npm · Package report

@backstage/backend-common: vulnerability history, versions and safety

@backstage/backend-common is a package in the npm ecosystem. Vulert records 1 vulnerability for it across 0 release, first recorded in Feb 2024. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
1 vulnerabilities recorded H1
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all @backstage/backend-common vulnerabilities

Vulert verdict on @backstage/backend-common 0.25.0 i

Updated on 23 Oct 2026

Good news: 0.25.0, the version you would install today, has no known vulnerabilities. Older releases do — the table below lists all 1.

Package health score 45/100
  • Security Minor issues
  • Maintenance Deprecated
  • Popularity Key ecosystem project
  • Community Moderate

The registry marks the latest release as deprecated, which caps this score.

What to do: Stay on 0.25.0 or newer. This can change: a vulnerability disclosed tomorrow can affect 0.25.0 too — Vulert watches the package and alerts you if that happens. Monitor it with Vulert →

  • Current release 0.25.0 — unaffected i
  • Vulnerabilities on record 1 over 1 year · 0 in the last year i
  • Latest disclosure 23 Feb 2024 i
  • Highest CVSS 8.7 i
  • With no published fix 0 i
  • Depended on by 659 packages i
  • Stars 34,659 i
  • OpenSSF scorecard 6/10 i
  • Last release 25 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the npm registry, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for @backstage/backend-common, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
0.25.0 17 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240917021806 17 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240916023337 16 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240915023307 15 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240914022633 14 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240913023025 13 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240912022955 12 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240911022723 11 Sep 2024 none Apache-2.0 — Details →
0.25.0-next.2 10 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240910023018 10 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240909023012 09 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240908023050 08 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240907022659 07 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240906022905 06 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240905022851 05 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240904022810 04 Sep 2024 none Apache-2.0 — Details →
0.25.0-next.1 03 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240903022649 03 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240902022856 02 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240901023519 01 Sep 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240831022709 31 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240830022837 30 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240829022758 29 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240828022712 28 Aug 2024 none Apache-2.0 — Details →
0.25.0-next.0 27 Aug 2024 none Apache-2.0 — Details →
0.24.1 27 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240827082736 27 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240827022616 27 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240826083204 26 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240826071828 26 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240826022541 26 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240825022831 25 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240825022300 25 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240824022004 24 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240823021944 23 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240822021958 22 Aug 2024 none Apache-2.0 — Details →
0.24.0 20 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240820021901 20 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240819022007 19 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240818022051 18 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240817021759 17 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240816021916 16 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240815021638 15 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240814021923 14 Aug 2024 none Apache-2.0 — Details →
0.23.4-next.3 13 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240813022007 13 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240812022035 12 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240811022228 11 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240810021908 10 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240809021939 09 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240808021919 08 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240807021931 07 Aug 2024 none Apache-2.0 — Details →
0.23.4-next.2 06 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240806021838 06 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240805021931 05 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240804022043 04 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240803021741 03 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240802021846 02 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240801022222 01 Aug 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240731020649 31 Jul 2024 none Apache-2.0 — Details →
0.23.4-next.1 30 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240730021827 30 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240729022006 29 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240728022021 28 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240727021731 27 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240726021825 26 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240725021815 25 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240724021820 24 Jul 2024 none Apache-2.0 — Details →
0.23.4-next.0 23 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240723021837 23 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240722022006 22 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240721021945 21 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240720021712 20 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240719021809 19 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240718021752 18 Jul 2024 none Apache-2.0 — Details →
0.23.3 16 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240716021845 16 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240715022028 15 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240714022233 14 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240713021735 13 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240712021724 12 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240711021914 11 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240710021803 10 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240709021815 09 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240708021827 08 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240707021930 07 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240706021623 06 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240705021713 05 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240704021728 04 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240703021716 03 Jul 2024 none Apache-2.0 — Details →
0.23.3-next.1 02 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240702021736 02 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240701022140 01 Jul 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240630021930 30 Jun 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240629021635 29 Jun 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240628021735 28 Jun 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240627021712 27 Jun 2024 none Apache-2.0 — Details →
0.23.2 26 Jun 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240626021705 26 Jun 2024 none Apache-2.0 — Details →
0.23.2-next.0 25 Jun 2024 none Apache-2.0 — Details →
0.0.0-nightly-20240625021714 25 Jun 2024 none — — Details →
0.0.0-nightly-20240624021816 24 Jun 2024 none — — Details →
0.0.0-nightly-20240623021817 23 Jun 2024 none — — Details →
0.0.0-nightly-20240622021615 22 Jun 2024 none — — Details →
0.0.0-nightly-20240621021638 21 Jun 2024 none — — Details →
0.0.0-nightly-20240620021703 20 Jun 2024 none — — Details →
0.23.1 19 Jun 2024 none — — Details →
0.23.0 18 Jun 2024 none — — Details →
0.0.0-nightly-20240618021721 18 Jun 2024 none — — Details →
0.0.0-nightly-20240617021823 17 Jun 2024 none — — Details →
0.0.0-nightly-20240616021858 16 Jun 2024 none — — Details →
0.0.0-nightly-20240615021640 15 Jun 2024 none — — Details →
0.0.0-nightly-20240614021713 14 Jun 2024 none — — Details →
0.0.0-nightly-20240613021705 13 Jun 2024 none — — Details →
0.0.0-nightly-20240612021718 12 Jun 2024 none — — Details →
0.23.0-next.3 11 Jun 2024 none — — Details →
0.0.0-nightly-20240611021715 11 Jun 2024 none — — Details →
0.0.0-nightly-20240610021801 10 Jun 2024 none — — Details →
0.0.0-nightly-20240609021850 09 Jun 2024 none — — Details →
0.0.0-nightly-20240608021631 08 Jun 2024 none — — Details →

The newest 120 of 1,347 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 1 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for @backstage/backend-common

The 1 most severe of 1 vulnerabilities recorded for this package

Search all 1 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2024-26150: Path Traversal Vulnerability in @backstage/backend-common 8.7 high 0.21.1 23 Feb 2024

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About @backstage/backend-common

Is @backstage/backend-common safe to use?

Vulert records 1 vulnerabilities for @backstage/backend-common in npm: 0 critical, 1 high, 0 medium and 0 low. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is @backstage/backend-common's Vulert package health score?

Vulert scores @backstage/backend-common 45/100, which reads as risky. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The registry marks the latest release as deprecated, which caps this score.

Is the latest version of @backstage/backend-common affected?

No. 0.25.0, the version you would install today, has no vulnerabilities on record against it. Earlier releases do — the version table above lists each release with what affects it.

Which version of @backstage/backend-common should I use?

0.24.1 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does @backstage/backend-common have?

1 vulnerability is recorded for @backstage/backend-common in the npm ecosystem: 0 critical, 1 high, 0 medium and 0 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new @backstage/backend-common vulnerabilities disclosed?

0 vulnerabilities were recorded for @backstage/backend-common in the last 12 months, and the oldest entry in this database dates to 23 Feb 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of @backstage/backend-common are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor @backstage/backend-common for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the @backstage/backend-common version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.