Is bitwarden/server OK?

Mostly.

A serious flaw in what it ships.

Internal: 28 flaws in tests and tools, none reaches your users.

Checked 17:01 UTCcommit 00d954fadvisories as of 16:48 UTC

No lockfile for AppHost/AppHost.csproj: only the versions written there were checked, not the packages they bring in.

Post on X

6 things to update

Update Microsoft.EntityFrameworkCore.SqliteSomeone could change data or files.
- SQLitePCLRaw.lib.e_sqlite3 2.1.61 flaw
  Someone could change data or files. Only with an account.
  - GHSA-2m69-gcr7-jv3qSQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite
Update AutoMapper to 15.1.1Someone could make it crash or freeze.
- AutoMapper 14.0.01 flawfixed in 15.1.1
  Someone could make it crash or freeze. From anywhere online, no account needed.
  - GHSA-rvv3-g6hj-g44xAutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
Update Azure.Extensions.AspNetCore.DataProtection.BlobsSomeone could make it crash or freeze.
- System.Security.Cryptography.Xml 10.0.103 flawsfixed in 10.0.13
  Someone could make it crash or freeze. From anywhere online, no account needed.
  - GHSA-7hqp-7c5m-4vq6Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability
  - GHSA-c399-9853-6jmjMicrosoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability
  - GHSA-r955-8q5j-3h83Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability
- System.Security.Cryptography.Pkcs 10.0.102 flawsfixed in 10.0.13
  Someone could make it crash or freeze. From anywhere online, no account needed.
  - GHSA-846f-f764-76mxMicrosoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
  - GHSA-2fmv-rv2c-59x7Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability

Update MailKitSomeone could make it crash or freeze.
- System.Security.Cryptography.Pkcs 10.0.02 flawsfixed in 10.0.13
  Someone could make it crash or freeze. From anywhere online, no account needed.
  - GHSA-846f-f764-76mxMicrosoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
  - GHSA-2fmv-rv2c-59x7Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
Update mjmlSomeone could make it crash or freeze.
- undici 7.29.13 flawsfixed in 7.30.1
  Someone could change data or files. From anywhere online, no account needed.
  - GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
  - GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
  - GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
- source-map-js 1.2.11 flawfixed in 1.2.2
  Someone could make it crash or freeze. From anywhere online, no account needed.
  - GHSA-68fv-2mgg-jv7qsource-map-js allows event-loop denial of service through indexed source-map section offsets
- Show 2 more
  - brace-expansion 5.0.93 flawsfixed in 5.0.12
    Someone could make it crash or freeze. From anywhere online, no account needed.
    GHSA-6j4f-fj2g-mc7pbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
    GHSA-qhr7-859c-m2p7brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
    GHSA-q2hr-2g5m-vwhrbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
  - undici 6.28.12 flawsfixed in 6.29.1
    Someone could make it crash or freeze. From anywhere online, no account needed.
    GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
    GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
Update Swashbuckle.AspNetCore.SwaggerGenSomeone could make it crash or freeze.
- Microsoft.OpenApi 2.4.11 flawfixed in 2.7.5
  Someone could make it crash or freeze. From anywhere online, no account needed.
  - GHSA-v5pm-xwqc-g5wcMicrosoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

Touches your users

31 flaws in what the project ships, the gravest first.

Can expose your users' data or let someone take over

rsa 0.10.0-rc.181 flawSomeone could read data they should not see. From anywhere online, no account needed.
- RUSTSEC-2023-0071Marvin Attack: potential key recovery through timing sidechannels
rustls 0.23.424 flawsfixed in 0.23.46Someone could read data they should not see. Only with access to the machine.
- RUSTSEC-2026-0346`Debug` impls for client session values expose TLS secrets
- GHSA-2mjx-qc3c-rqvcRustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
- RUSTSEC-2026-0348Brotli certificate decompression can allocate up to 1 GiB before authentication
- RUSTSEC-2026-0349Unauthenticated ServerHello can downgrade later connections to classical key exchange
SQLitePCLRaw.lib.e_sqlite3 2.1.61 flawSomeone could change data or files. Only with an account.
- GHSA-2m69-gcr7-jv3qSQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite
undici 7.29.13 flawsfixed in 7.30.1Someone could change data or files. From anywhere online, no account needed.
- GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
- GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

Can break or slow your service

source-map-js 1.2.11 flawfixed in 1.2.2Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-68fv-2mgg-jv7qsource-map-js allows event-loop denial of service through indexed source-map section offsets
brace-expansion 5.0.93 flawsfixed in 5.0.12Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-6j4f-fj2g-mc7pbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
- GHSA-qhr7-859c-m2p7brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
- GHSA-q2hr-2g5m-vwhrbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
System.Security.Cryptography.Xml 10.0.103 flawsfixed in 10.0.13Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-7hqp-7c5m-4vq6Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability
- GHSA-c399-9853-6jmjMicrosoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability
- GHSA-r955-8q5j-3h83Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability
System.Security.Cryptography.Pkcs 10.0.02 flawsfixed in 10.0.13Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-846f-f764-76mxMicrosoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
- GHSA-2fmv-rv2c-59x7Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
System.Security.Cryptography.Pkcs 10.0.102 flawsfixed in 10.0.13Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-846f-f764-76mxMicrosoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
- GHSA-2fmv-rv2c-59x7Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability

AutoMapper 14.0.01 flawfixed in 15.1.1Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-rvv3-g6hj-g44xAutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
Microsoft.OpenApi 2.4.11 flawfixed in 2.7.5Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-v5pm-xwqc-g5wcMicrosoft.OpenAPI: Circular schema references may terminate OpenAPI parsing
undici 6.28.12 flawsfixed in 6.29.1Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
Microsoft.AspNetCore.SignalR.Protocols.MessagePack 10.0.101 flawfixed in 10.0.13Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-86xp-94pg-8r6rMicrosoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability
h2 0.4.151 flawfixed in 0.4.16A flaw whose effect is not spelled out.
- RUSTSEC-2026-0258h2 unbounded empty DATA frames
rustls-webpki 0.103.131 flawfixed in 0.103.16A flaw whose effect is not spelled out.
- RUSTSEC-2026-0382Certificate verification may accept distrusted intermediates
webpki-root-certs 1.0.91 flawfixed in 1.0.10A flaw whose effect is not spelled out.
- RUSTSEC-2026-0383Bundled root certificates allow trust in distrusted emSign intermediates
ctutils 0.4.21 flawfixed in 0.4.4A flaw whose effect is not spelled out.
- RUSTSEC-2026-0385Non-constant-time mask generation and `u128` comparisons
tokio 1.53.01 flawfixed in 1.53.3A flaw whose effect is not spelled out.
- RUSTSEC-2026-0386`AsyncFd::new` and related constructors violate I/O safety
crypto-bigint 0.7.51 flawfixed in 0.7.6A flaw whose effect is not spelled out.
- RUSTSEC-2026-0387Multiple timing variability issues in operations intended to be constant-time

Internal only

Dev tools, tests, examples, docs and benchmarks: they do not reach your users, so they never count in the answer.

SSH.NET 2025.1.02 flawsfixed in 2026.0.0Someone could run their own code where it runs. Only with an account.
- GHSA-mggc-4xg6-vcxfSSH.NET: ScpClient allows server-side RCE via default SCP path handling
- GHSA-q939-rpr3-3284SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
fast-uri 3.1.312 flawsfixed in 3.1.9Someone could read data they should not see. From anywhere online, no account needed.
- GHSA-f65p-4m7j-42xcfast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
- GHSA-fph4-wmhf-6fwffast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
- GHSA-5jgf-p345-68v8fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
- GHSA-7p8r-x3mc-p8w7fast-uri vulnerable to host confusion via backslash authority introducer
- GHSA-jqff-g426-hqxpfast-uri vulnerable to host confusion via percent-encoded scheme normalization
- GHSA-v2hh-gcrm-f6hxfast-uri vulnerable to host confusion via literal backslash authority delimiter
- GHSA-qw65-cvwx-89v3fast-uri vulnerable to authority injection via an unvalidated port in serialize
- GHSA-333x-w4r6-6crpfast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
- GHSA-hrr3-gc8f-f4qjfast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
- GHSA-w74x-v6f9-j3xgfast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
- GHSA-wjr9-j795-jxcrfast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
- GHSA-xhq7-xmqj-769hfast-uri vulnerable to improper path equivalence in relative reference normalization
postcss 8.5.172 flawsfixed in 8.5.23Someone could read data they should not see. From anywhere online, no account needed.
- GHSA-r28c-9q8g-f849PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
- GHSA-fxqj-rqcc-2cmpPostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
browserslist 4.28.62 flawsfixed in 4.28.7Someone could change data or files. From anywhere online, no account needed.
- GHSA-73wf-gq98-2v4gBrowserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
- GHSA-c83g-rgw3-j3cxBrowserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
nanoid 3.3.152 flawsfixed in 3.3.18Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-28wg-ghj8-5hjvnanoid: non-secure generators can loop indefinitely with negative size
- GHSA-2v37-7h3g-55p8nanoid: custom generators can loop indefinitely when size is zero
Microsoft.AspNetCore.SignalR.Common 10.0.101 flawfixed in 10.0.13Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-334f-vvp4-7g6pMicrosoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability
brace-expansion 1.1.165 flawsfixed in 1.1.21Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-6j4f-fj2g-mc7pbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
- GHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
- GHSA-qhr7-859c-m2p7brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
- GHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
- GHSA-q2hr-2g5m-vwhrbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
postcss-selector-parser 7.1.41 flawfixed in 7.1.6Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-rj75-hqrm-r3gfPostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
baseline-browser-mapping 2.10.431 flawfixed in 2.11.0Someone could make it crash or freeze. From anywhere online, no account needed.
- GHSA-w5vr-8v7q-w6rvbaseline-browser-mapping process termination on invalid input causes denial of service

Email me when this changes

One email to confirm, then one only when the answer gets worse or a new serious flaw appears: at most one a day, at once if attackers use it. One click to unsubscribe.

Put the badge in your README

It shows this answer and changes with it.

[![Is bitwarden/server OK?](https://istheinternetok.com/r/bitwarden/server/badge.svg)](https://istheinternetok.com/r/bitwarden/server/)

Read from bitwarden_license/src/Commercial.Core/packages.lock.json, bitwarden_license/src/Commercial.Infrastructure.EntityFramework/packages.lock.json, bitwarden_license/src/Scim/packages.lock.json, bitwarden_license/src/Services/Pam/packages.lock.json, bitwarden_license/src/Sso/package-lock.json, bitwarden_license/src/Sso/packages.lock.json, bitwarden_license/test/Commercial.Core.Test/packages.lock.json, bitwarden_license/test/SSO.Test/packages.lock.json, bitwarden_license/test/Scim.IntegrationTest/packages.lock.json, bitwarden_license/test/Scim.Test/packages.lock.json, bitwarden_license/test/Services/Pam.IntegrationTest/packages.lock.json, bitwarden_license/test/Services/Pam.Test/packages.lock.json, bitwarden_license/test/Sso.IntegrationTest/packages.lock.json, perf/MicroBenchmarks/packages.lock.json, src/Admin/package-lock.json, src/Admin/packages.lock.json, src/Api/packages.lock.json, src/Billing/packages.lock.json, src/Core/MailTemplates/Mjml/package-lock.json, src/Core/packages.lock.json, src/Events/packages.lock.json, src/EventsProcessor/packages.lock.json, src/HttpExtensions/packages.lock.json, src/Icons/packages.lock.json, src/Identity/packages.lock.json, src/Infrastructure.Dapper/packages.lock.json, src/Infrastructure.EntityFramework/packages.lock.json, src/Libraries/Data/packages.lock.json, src/Libraries/ExceptionHandling/packages.lock.json, src/Libraries/GlobalSettingsBridge/packages.lock.json, src/Libraries/Invoicing/packages.lock.json, src/Libraries/OrganizationAuthorization/packages.lock.json, src/Libraries/SerilogFileLogging/packages.lock.json, src/Libraries/SsrfProtection/packages.lock.json, src/Libraries/Subscriptions.Organization/packages.lock.json, src/Libraries/Subscriptions.User/packages.lock.json, src/Notifications/packages.lock.json, src/Pam.Domain/packages.lock.json, src/SharedWeb/packages.lock.json, src/Sql/packages.lock.json, test/Admin.Test/packages.lock.json, test/Api.IntegrationTest/packages.lock.json, test/Api.Test/packages.lock.json, test/Billing.IntegrationTest/packages.lock.json, test/Billing.Test/packages.lock.json, test/Common/packages.lock.json, test/Core.IntegrationTest/packages.lock.json, test/Core.Test/packages.lock.json, test/Events.IntegrationTest/packages.lock.json, test/Events.Test/packages.lock.json, test/EventsProcessor.Test/packages.lock.json, test/HttpExtensions.Test/packages.lock.json, test/Icons.Test/packages.lock.json, test/Identity.IntegrationTest/packages.lock.json, test/Identity.Test/packages.lock.json, test/Infrastructure.Dapper.Test/packages.lock.json, test/Infrastructure.IntegrationTest/packages.lock.json, test/IntegrationTestCommon/packages.lock.json, test/Libraries/Data.Test/packages.lock.json, test/Libraries/ExceptionHandling.Test/packages.lock.json, test/Libraries/GlobalSettingsBridge.Test/packages.lock.json, test/Libraries/Invoicing.Test/packages.lock.json, test/Libraries/OrganizationAuthorization.Test/packages.lock.json, test/Libraries/SerilogFileLogging.Test/packages.lock.json, test/Libraries/SsrfProtection.Test/packages.lock.json, test/Libraries/Subscriptions.Organization.Test/packages.lock.json, test/Libraries/Subscriptions.User.Test/packages.lock.json, test/Migrator.Test/packages.lock.json, test/Notifications.Test/packages.lock.json, test/SeederApi.IntegrationTest/packages.lock.json, test/Server.IntegrationTest/packages.lock.json, test/Setup.Test/packages.lock.json, test/SharedWeb.Test/packages.lock.json, util/Migrator/packages.lock.json, util/MsSqlMigratorUtility/packages.lock.json, util/MySqlMigrations/packages.lock.json, util/PostgresMigrations/packages.lock.json, util/RustSdk/packages.lock.json, util/RustSdk/rust/Cargo.lock, util/Seeder/packages.lock.json, util/SeederApi/packages.lock.json, util/SeederUtility/packages.lock.json, util/Server/packages.lock.json, util/Setup/packages.lock.json, util/SqlServerEFScaffold/packages.lock.json, util/SqliteMigrations/packages.lock.json, AppHost/AppHost.csproj.