unleash-server

Unleash is an enterprise ready feature flag service. It provides different strategies for handling feature flags.

Latest 8.2.0

NPM

91%

Total Score

Maintainer Stability

100

Dependencies

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Dependency profile

The package declares 66 runtime dependencies, creating a meaningful transitive maintenance and supply-chain surface, but the signal does not show abnormal or clearly unmanaged dependencies.

Lifecycle scripts

postinstall, prepack, and prepare scripts increase installation and publication complexity and therefore warrant review, although this is not by itself evidence of abandonment or maliciousness.

Security policy

No SECURITY.md or equivalent security policy was detected, reducing vulnerability-reporting transparency despite the repository's other security tooling.

Token permissions

Twelve of 22 workflows lack top-level permissions declarations and 10 declare top-level write access, with no workflows identified as read-only; this is a meaningful CI least-privilege hygiene gap.

Vulnerabilities

Title	Versions	Severity
CVE-2026-77426 unleash-server is vulnerable to Authorization Bypass Through User-Controlled Key in versions 0.0.0 - 8.0.3.	0.0.0 - 8.0.3	High
CVE-2026-77425 unleash-server is vulnerable to Authorization Bypass Through User-Controlled Key in versions 0.0.0 - 8.0.3.	0.0.0 - 8.0.3	Medium
CVE-2026-76910 unleash-server is vulnerable to Authorization Bypass Through User-Controlled Key in versions 0.0.0 - 8.0.3.	0.0.0 - 8.0.3	Medium
CVE-2026-76909 unleash-server is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 8.0.3.	0.0.0 - 8.0.3	Low
CVE-2026-63466 unleash-server is vulnerable to Improper Encoding or Escaping of Output in versions 0.0.0 - 8.0.3.	0.0.0 - 8.0.3	Medium