CVE-2026-31839
High · 8.2CVSS
8.2
EPSS
0.2%
Published
Mar 11, 2026
CISA due date
—
The record
Striae is a firearms examiner's comparison companion. A high-severity integrity bypass vulnerability existed in Striae's digital confirmation workflow prior to v3.0.0. Hash-only validation trusted manifest hash fields that could be modified together with package content, allowing tampered confirmation packages to pass integrity checks. This vulnerability is fixed in 3.0.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @striae-org/striae | 0.9.22-0 | 3.0.0 |
Related vulnerabilities
- GHSA-mmf8-487q-p45m Striae has a hash validation utility vulnerability Same vulnerability
- CVE-2026-35501 When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both… CWE-354
- CVE-2026-85747 Distribution is a toolkit to pack, ship, store, and deliver container content. CWE-354
- CVE-2026-20354 Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME)… CWE-354
- CVE-2026-82549 A vulnerability was identified in Linux Foundation Magma 1.9.0. CWE-354
- CVE-2025-61480 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a… CWE-354
- CVE-2026-75803 Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can… CWE-354
- CVE-2026-12816 In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via… CWE-354