wrangler
4.151.3 · 20 Oct 2026MIT OR Apache-2.018.1M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for wrangler. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 4.151.3 | Safe from 4.59.1 | |
| 3.114.17 | Safe from 3.114.17 | |
| 2.21.3 | 2 open advisories, worst high · last release Mar 2025, no longer updated |
- CriticalArbitrary remote code execution within `wrangler dev` Workers sandboxGHSA-f8mp-x433-5wpf · 3 Jan 2024
- 3.x3.0.0 – 3.18.0Fixed in 3.19.0
- 2.x2.0.0 – 2.20.1Fixed in 2.20.2
- HighWrangler affected by OS Command Injection in `wrangler pages deploy`GHSA-36p8-mvp6-cv38 · 21 Jan 2026
- 4.x4.0.0 – 4.59.0Fixed in 4.59.1
- 3.x3.0.0 – 3.114.16Fixed in 3.114.17
- 2.x2.0.15 – 2.21.3No fix on 2.x · move to 3.114.17
- ModerateArbitrary remote file read in Wrangler dev serverGHSA-cfph-4qqh-w828 · 3 Jan 2024
- 3.x3.9.0 – 3.18.0Fixed in 3.19.0
- ModerateCloudflare Wrangler directory traversal vulnerabilityGHSA-8c93-4hch-xgxp · 3 Aug 2023
- 2.x2.0.0 – 2.20.0Fixed in 2.20.1
- 0.0.x0.0.1 – 0.0.34No fix on 0.0.x · move to 2.20.1
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.