bitwarden/server 还好吗？

基本好。

它发布的内容里有一个重大漏洞。

内部：测试和工具里有 28 个漏洞，都不会影响你的用户。

17:04 UTC检查提交 00d954f公告截至 16:48 UTC

AppHost/AppHost.csproj 没有锁文件：只检查了其中写明的版本，没有检查它们带进来的包。

发布到 X

有 6 件事要更新

更新 Microsoft.EntityFrameworkCore.Sqlite有人可以篡改数据或文件。
- SQLitePCLRaw.lib.e_sqlite3 2.1.61 个漏洞
  有人可以篡改数据或文件。必须有账号。
  - GHSA-2m69-gcr7-jv3qSQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite
把 AutoMapper 更新到 15.1.1有人可以让它崩溃或卡死。
- AutoMapper 14.0.01 个漏洞已在 15.1.1 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-rvv3-g6hj-g44xAutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
更新 Azure.Extensions.AspNetCore.DataProtection.Blobs有人可以让它崩溃或卡死。
- System.Security.Cryptography.Xml 10.0.103 个漏洞已在 10.0.13 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-7hqp-7c5m-4vq6Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability
  - GHSA-c399-9853-6jmjMicrosoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability
  - GHSA-r955-8q5j-3h83Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability
- System.Security.Cryptography.Pkcs 10.0.102 个漏洞已在 10.0.13 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-846f-f764-76mxMicrosoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
  - GHSA-2fmv-rv2c-59x7Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability

更新 MailKit有人可以让它崩溃或卡死。
- System.Security.Cryptography.Pkcs 10.0.02 个漏洞已在 10.0.13 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-846f-f764-76mxMicrosoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
  - GHSA-2fmv-rv2c-59x7Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
更新 mjml有人可以让它崩溃或卡死。
- undici 7.29.13 个漏洞已在 7.30.1 中修复
  有人可以篡改数据或文件。从网上任何地方都行，不需要账号。
  - GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
  - GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
  - GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
- source-map-js 1.2.11 个漏洞已在 1.2.2 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-68fv-2mgg-jv7qsource-map-js allows event-loop denial of service through indexed source-map section offsets
- 再显示 2 条
  - brace-expansion 5.0.93 个漏洞已在 5.0.12 中修复
    有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
    GHSA-6j4f-fj2g-mc7pbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
    GHSA-qhr7-859c-m2p7brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
    GHSA-q2hr-2g5m-vwhrbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
  - undici 6.28.12 个漏洞已在 6.29.1 中修复
    有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
    GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
    GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
更新 Swashbuckle.AspNetCore.SwaggerGen有人可以让它崩溃或卡死。
- Microsoft.OpenApi 2.4.11 个漏洞已在 2.7.5 中修复
  有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
  - GHSA-v5pm-xwqc-g5wcMicrosoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

影响你的用户

项目发布的内容里有 31 个漏洞，最严重的在前。

可能泄露用户数据，或让人接管

rsa 0.10.0-rc.181 个漏洞有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- RUSTSEC-2023-0071Marvin Attack: potential key recovery through timing sidechannels
rustls 0.23.424 个漏洞已在 0.23.46 中修复有人可以读到本不该看到的数据。必须能接触到这台机器。
- RUSTSEC-2026-0346`Debug` impls for client session values expose TLS secrets
- GHSA-2mjx-qc3c-rqvcRustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
- RUSTSEC-2026-0348Brotli certificate decompression can allocate up to 1 GiB before authentication
- RUSTSEC-2026-0349Unauthenticated ServerHello can downgrade later connections to classical key exchange
SQLitePCLRaw.lib.e_sqlite3 2.1.61 个漏洞有人可以篡改数据或文件。必须有账号。
- GHSA-2m69-gcr7-jv3qSQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite
undici 7.29.13 个漏洞已在 7.30.1 中修复有人可以篡改数据或文件。从网上任何地方都行，不需要账号。
- GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
- GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

可能让你的服务崩溃或变慢

source-map-js 1.2.11 个漏洞已在 1.2.2 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-68fv-2mgg-jv7qsource-map-js allows event-loop denial of service through indexed source-map section offsets
brace-expansion 5.0.93 个漏洞已在 5.0.12 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-6j4f-fj2g-mc7pbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
- GHSA-qhr7-859c-m2p7brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
- GHSA-q2hr-2g5m-vwhrbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
System.Security.Cryptography.Xml 10.0.103 个漏洞已在 10.0.13 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-7hqp-7c5m-4vq6Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability
- GHSA-c399-9853-6jmjMicrosoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability
- GHSA-r955-8q5j-3h83Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability
System.Security.Cryptography.Pkcs 10.0.02 个漏洞已在 10.0.13 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-846f-f764-76mxMicrosoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
- GHSA-2fmv-rv2c-59x7Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
System.Security.Cryptography.Pkcs 10.0.102 个漏洞已在 10.0.13 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-846f-f764-76mxMicrosoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
- GHSA-2fmv-rv2c-59x7Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability

AutoMapper 14.0.01 个漏洞已在 15.1.1 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-rvv3-g6hj-g44xAutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
Microsoft.OpenApi 2.4.11 个漏洞已在 2.7.5 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-v5pm-xwqc-g5wcMicrosoft.OpenAPI: Circular schema references may terminate OpenAPI parsing
undici 6.28.12 个漏洞已在 6.29.1 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
Microsoft.AspNetCore.SignalR.Protocols.MessagePack 10.0.101 个漏洞已在 10.0.13 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-86xp-94pg-8r6rMicrosoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability
h2 0.4.151 个漏洞已在 0.4.16 中修复一个影响未说明的漏洞。
- RUSTSEC-2026-0258h2 unbounded empty DATA frames
rustls-webpki 0.103.131 个漏洞已在 0.103.16 中修复一个影响未说明的漏洞。
- RUSTSEC-2026-0382Certificate verification may accept distrusted intermediates
webpki-root-certs 1.0.91 个漏洞已在 1.0.10 中修复一个影响未说明的漏洞。
- RUSTSEC-2026-0383Bundled root certificates allow trust in distrusted emSign intermediates
ctutils 0.4.21 个漏洞已在 0.4.4 中修复一个影响未说明的漏洞。
- RUSTSEC-2026-0385Non-constant-time mask generation and `u128` comparisons
tokio 1.53.01 个漏洞已在 1.53.3 中修复一个影响未说明的漏洞。
- RUSTSEC-2026-0386`AsyncFd::new` and related constructors violate I/O safety
crypto-bigint 0.7.51 个漏洞已在 0.7.6 中修复一个影响未说明的漏洞。
- RUSTSEC-2026-0387Multiple timing variability issues in operations intended to be constant-time

仅内部

开发工具、测试、示例、文档和基准测试：它们不会影响你的用户，所以从不计入答案。

SSH.NET 2025.1.02 个漏洞已在 2026.0.0 中修复有人可以在它运行的地方运行自己的代码。必须有账号。
- GHSA-mggc-4xg6-vcxfSSH.NET: ScpClient allows server-side RCE via default SCP path handling
- GHSA-q939-rpr3-3284SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
fast-uri 3.1.312 个漏洞已在 3.1.9 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-f65p-4m7j-42xcfast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
- GHSA-fph4-wmhf-6fwffast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
- GHSA-5jgf-p345-68v8fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
- GHSA-7p8r-x3mc-p8w7fast-uri vulnerable to host confusion via backslash authority introducer
- GHSA-jqff-g426-hqxpfast-uri vulnerable to host confusion via percent-encoded scheme normalization
- GHSA-v2hh-gcrm-f6hxfast-uri vulnerable to host confusion via literal backslash authority delimiter
- GHSA-qw65-cvwx-89v3fast-uri vulnerable to authority injection via an unvalidated port in serialize
- GHSA-333x-w4r6-6crpfast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
- GHSA-hrr3-gc8f-f4qjfast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
- GHSA-w74x-v6f9-j3xgfast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
- GHSA-wjr9-j795-jxcrfast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
- GHSA-xhq7-xmqj-769hfast-uri vulnerable to improper path equivalence in relative reference normalization
postcss 8.5.172 个漏洞已在 8.5.23 中修复有人可以读到本不该看到的数据。从网上任何地方都行，不需要账号。
- GHSA-r28c-9q8g-f849PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
- GHSA-fxqj-rqcc-2cmpPostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
browserslist 4.28.62 个漏洞已在 4.28.7 中修复有人可以篡改数据或文件。从网上任何地方都行，不需要账号。
- GHSA-73wf-gq98-2v4gBrowserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
- GHSA-c83g-rgw3-j3cxBrowserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
nanoid 3.3.152 个漏洞已在 3.3.18 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-28wg-ghj8-5hjvnanoid: non-secure generators can loop indefinitely with negative size
- GHSA-2v37-7h3g-55p8nanoid: custom generators can loop indefinitely when size is zero
Microsoft.AspNetCore.SignalR.Common 10.0.101 个漏洞已在 10.0.13 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-334f-vvp4-7g6pMicrosoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability
brace-expansion 1.1.165 个漏洞已在 1.1.21 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-6j4f-fj2g-mc7pbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
- GHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
- GHSA-qhr7-859c-m2p7brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
- GHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
- GHSA-q2hr-2g5m-vwhrbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
postcss-selector-parser 7.1.41 个漏洞已在 7.1.6 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-rj75-hqrm-r3gfPostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
baseline-browser-mapping 2.10.431 个漏洞已在 2.11.0 中修复有人可以让它崩溃或卡死。从网上任何地方都行，不需要账号。
- GHSA-w5vr-8v7q-w6rvbaseline-browser-mapping process termination on invalid input causes denial of service

有变化时发邮件给我

先发一封邮件请你确认，之后只在结论变差或出现新的严重漏洞时才发：每天最多一封，若攻击者正在利用则立即发送。一键退订。

把徽章放进你的 README

它显示这个答案，并随答案变化。

[![bitwarden/server 还好吗？](https://istheinternetok.com/r/bitwarden/server/badge.svg)](https://istheinternetok.com/r/bitwarden/server/)

读取自 bitwarden_license/src/Commercial.Core/packages.lock.json, bitwarden_license/src/Commercial.Infrastructure.EntityFramework/packages.lock.json, bitwarden_license/src/Scim/packages.lock.json, bitwarden_license/src/Services/Pam/packages.lock.json, bitwarden_license/src/Sso/package-lock.json, bitwarden_license/src/Sso/packages.lock.json, bitwarden_license/test/Commercial.Core.Test/packages.lock.json, bitwarden_license/test/SSO.Test/packages.lock.json, bitwarden_license/test/Scim.IntegrationTest/packages.lock.json, bitwarden_license/test/Scim.Test/packages.lock.json, bitwarden_license/test/Services/Pam.IntegrationTest/packages.lock.json, bitwarden_license/test/Services/Pam.Test/packages.lock.json, bitwarden_license/test/Sso.IntegrationTest/packages.lock.json, perf/MicroBenchmarks/packages.lock.json, src/Admin/package-lock.json, src/Admin/packages.lock.json, src/Api/packages.lock.json, src/Billing/packages.lock.json, src/Core/MailTemplates/Mjml/package-lock.json, src/Core/packages.lock.json, src/Events/packages.lock.json, src/EventsProcessor/packages.lock.json, src/HttpExtensions/packages.lock.json, src/Icons/packages.lock.json, src/Identity/packages.lock.json, src/Infrastructure.Dapper/packages.lock.json, src/Infrastructure.EntityFramework/packages.lock.json, src/Libraries/Data/packages.lock.json, src/Libraries/ExceptionHandling/packages.lock.json, src/Libraries/GlobalSettingsBridge/packages.lock.json, src/Libraries/Invoicing/packages.lock.json, src/Libraries/OrganizationAuthorization/packages.lock.json, src/Libraries/SerilogFileLogging/packages.lock.json, src/Libraries/SsrfProtection/packages.lock.json, src/Libraries/Subscriptions.Organization/packages.lock.json, src/Libraries/Subscriptions.User/packages.lock.json, src/Notifications/packages.lock.json, src/Pam.Domain/packages.lock.json, src/SharedWeb/packages.lock.json, src/Sql/packages.lock.json, test/Admin.Test/packages.lock.json, test/Api.IntegrationTest/packages.lock.json, test/Api.Test/packages.lock.json, test/Billing.IntegrationTest/packages.lock.json, test/Billing.Test/packages.lock.json, test/Common/packages.lock.json, test/Core.IntegrationTest/packages.lock.json, test/Core.Test/packages.lock.json, test/Events.IntegrationTest/packages.lock.json, test/Events.Test/packages.lock.json, test/EventsProcessor.Test/packages.lock.json, test/HttpExtensions.Test/packages.lock.json, test/Icons.Test/packages.lock.json, test/Identity.IntegrationTest/packages.lock.json, test/Identity.Test/packages.lock.json, test/Infrastructure.Dapper.Test/packages.lock.json, test/Infrastructure.IntegrationTest/packages.lock.json, test/IntegrationTestCommon/packages.lock.json, test/Libraries/Data.Test/packages.lock.json, test/Libraries/ExceptionHandling.Test/packages.lock.json, test/Libraries/GlobalSettingsBridge.Test/packages.lock.json, test/Libraries/Invoicing.Test/packages.lock.json, test/Libraries/OrganizationAuthorization.Test/packages.lock.json, test/Libraries/SerilogFileLogging.Test/packages.lock.json, test/Libraries/SsrfProtection.Test/packages.lock.json, test/Libraries/Subscriptions.Organization.Test/packages.lock.json, test/Libraries/Subscriptions.User.Test/packages.lock.json, test/Migrator.Test/packages.lock.json, test/Notifications.Test/packages.lock.json, test/SeederApi.IntegrationTest/packages.lock.json, test/Server.IntegrationTest/packages.lock.json, test/Setup.Test/packages.lock.json, test/SharedWeb.Test/packages.lock.json, util/Migrator/packages.lock.json, util/MsSqlMigratorUtility/packages.lock.json, util/MySqlMigrations/packages.lock.json, util/PostgresMigrations/packages.lock.json, util/RustSdk/packages.lock.json, util/RustSdk/rust/Cargo.lock, util/Seeder/packages.lock.json, util/SeederApi/packages.lock.json, util/SeederUtility/packages.lock.json, util/Server/packages.lock.json, util/Setup/packages.lock.json, util/SqlServerEFScaffold/packages.lock.json, util/SqliteMigrations/packages.lock.json, AppHost/AppHost.csproj。