rollup

4.64.12 · 20 Oct 2026MIT75.2M / weekRepository Homepage npm Atom feed

Security advisories

From OSV. Open ones first, then the most severe. "Fixed in" is read against the latest release, 4.64.12.

Severity	Advisory	Affected	Fixed in
High	Rollup 4 has Arbitrary File Write via Path TraversalGHSA-mw96-cpmx-2vgc · 25 Feb 2026	< 2.80.0 · >= 3.0.0, < 3.30.0 · >= 4.0.0, < 4.59.0	4.59.0
High	DOM Clobbering Gadget found in rollup bundled scripts that leads to XSSGHSA-gcx4-mw62-g8wm · 23 Sept 2024	>= 3.0.0, < 3.29.5 · >= 4.0.0, < 4.22.4 · < 2.79.2	4.22.4

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.