All vulnerabilities
CVE-2026-114086GHSA-59h8-w5q6-mfmp

Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

triggerdotdev trigger.devnpmFrameworks
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.5.5Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 4.5.5trigger.devCVE List
  • 4.5.5trigger.dev, npmOSVnpm install trigger.dev@4.5.5

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to inject arbitrary data into any environment's realtime stream, including production.

Text from CVE List

Affected versions 3

  • trigger.devaffected: all versions before 4.5.5CVE List
  • trigger.devunaffected: 4.5.5CVE List
  • trigger.dev, npmfrom first release, fixed in 4.5.5OSV

References 2