Which versions of Node.js are affected by EUVD-2026-44765?

Three SAP CAP Node.js database packages (@cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, @cap-js/db-service@2.10.1) were compromised at the source on April 29, 2026, delivering credential-harvesting…. A patch is available.

How to fix or mitigate EUVD-2026-44765?

Within 24 hours: Identify all machines and CI systems that installed the three affected package versions using npm audit logs, dependency manifests, and CI history; immediately rotate all credentials (npm tokens, cloud API keys, SSH keys, GitHub personal access tokens, database passwords) for any developer or service account that may have used these packages. Within 7 days: Scan all affected systems for unauthorized access, lateral movement attempts, and command-and-control beacons; apply vendor-released patch to upgrade beyond the compromised versions; conduct forensic review of git commits, deployments, and infrastructure changes made from affected systems during the exposure window. Within 30 days: Conduct full supply-chain audit of npm dependencies with focus on all transitive dependencies; implement cryptographic signature verification for all npm installations; require MFA on all developer accounts and service credentials; evaluate migration to private package registries or implementation of dependency scanning with provenance verification.

Node.js EUVD-2026-44765

Q: What is the CVSS score of EUVD-2026-44765?

EUVD-2026-44765 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-46421 CRITICAL

Embedded Malicious Code (CWE-506)

2026-05-20 https://github.com/cap-js/cds-dbs

GHSA-pvw4-cvr4-97p8

Node.js PostgreSQL Information Disclosure

9.3

CVSS 4.0 · Vendor: https://github.com/cap-js/cds-dbs

Severity by source

Vendor (https://github.com/cap-js/cds-dbs) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (https://github.com/cap-js/cds-dbs) · only source for this CVE.

CVSS VectorVendor: https://github.com/cap-js/cds-dbs

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 15, 2026 - 19:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 19:22 NVD

9.3 (CRITICAL)

Source Code Evidence Fetched

May 20, 2026 - 16:30 vuln.today

Analysis Generated

May 20, 2026 - 16:30 vuln.today

DescriptionCVE.org

Impact

On April 29, 2026, compromised versions of @cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, and @cap-js/db-service@2.10.1 were published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised.

Patches

Upgrade to @cap-js/sqlite >= 2.4.0, @cap-js/postgres >= 2.3.0, @cap-js/db-service >= 2.11.0. If a compromised version was ever installed, rotate all affected credentials.

Workarounds

No workarounds.

AnalysisAI

Supply-chain compromise of SAP's Cloud Application Programming (CAP) Node.js database packages, where trojanized versions @cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, and @cap-js/db-service@2.10.1 were published to npm on April 29, 2026, harvesting all local credentials (npm tokens, cloud keys, SSH keys, GitHub PATs) and attempting worm-like self-propagation. Any developer or CI pipeline that installed these versions must treat every credential on the affected machine as compromised. Rated CVSS 4.0 9.3 (Critical); EPSS is low (0.03%) and it is not in CISA KEV, but the malicious code was itself actively distributed via npm — a 'mini Shai-Hulud' style attack.