go package report

Is github.com/nuts-foundation/nuts-node safe?

1 known vulnerability, worst severity MODERATE.

cvss

4.4

how bad it is if exploited, out of 10

epss

0.10%

chance of exploitation in the next 30 days

xyz score

not scored

CyberXYZ composite, out of 10

fig. 01 — GHSA-9hmg-827w-9rhj, the advisory selected below

// advisories

GHSA-9hmg-827w-9rhj

MODERATECVE-2026-41164

The v1 access token introspection endpoint (/auth/v1/introspectaccesstoken) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active: true introspection response.

Affected: >=0
Fixed in: not stated
Weakness: CWE-345
Published: 2026-05-05
Source: osv

NVD MITRE OSV

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.

Checked 2026-09-22 at 01:30 UTC. The most recent advisory here was published 2026-05-05. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is github.com/nuts-foundation/nuts-node safe? go package security report | CyberXYZ