Is CVE-2026-45773 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45773 being exploited in the wild.

How severe is CVE-2026-45773?

Medium severity, with a CVSS score of 4, published 15 May 2026.

Which products and versions are affected?

turbo (npm) SEMVER:introduced=0,fixed=2.9.14; Vercel Turbo < 2.9.14, <= 2.9.13.

Is there a fix for CVE-2026-45773?

Yes. turbo (npm): upgrade to 2.9.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45773 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45773?

Check whether you run turbo (npm) or Vercel Turbo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45773: Vercel Turborepo CSRF and session fixation in self-hosted login flow

Q: Is there a fix for CVE-2026-45773?

Yes. turbo (npm): upgrade to 2.9.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45773 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45773?

Check whether you run turbo (npm) or Vercel Turbo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45773 · Severity: medium · CVSS 4 · Published 2026-05-15

Turborepo is a build system used to manage and speed up JavaScript and TypeScript projects. A security flaw in its login process for self-hosted environments could allow a malicious website to hijack a developer's authentication session. If exploited, a developer's local command-line tool could be logged into an attacker's account instead of their own, potentially leading to the exposure of build data or incorrect configuration.

Technologies: Vercel Turbo. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-45773 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45773 being exploited in the wild.
How severe is CVE-2026-45773?: Medium severity, with a CVSS score of 4, published 15 May 2026.
Which products and versions are affected?: turbo (npm) SEMVER:introduced=0,fixed=2.9.14; Vercel Turbo < 2.9.14, <= 2.9.13.
Is there a fix for CVE-2026-45773?: Yes. turbo (npm): upgrade to 2.9.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45773 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45773?: Check whether you run turbo (npm) or Vercel Turbo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

turbo (npm): upgrade to 2.9.14 or later
```
npm install turbo@2.9.14
```

Technical details

Turborepo's CLI (turbo) fails to validate a CSRF 'state' parameter during the localhost callback phase of the browser-based SSO/login flow. An attacker can host a malicious webpage that sends a forged request containing an attacker-controlled token to the local callback server (typically listening on a high port on localhost) while the user is attempting to authenticate. If the malicious request reaches the CLI before the legitimate one, the CLI will adopt the attacker's session. This vulnerability specifically affects self-hosted remote cache/auth configurations; Vercel-hosted flows using device authorization are not impacted. The issue is fixed in version 2.9.14 by implementing mandatory state validation.

Affected products

Vercel turbo <= 2.9.13

Identifiers

CVE-2026-45773
GHSA-hcf7-66rw-9f5r

Timeline

2026-05-14: advisory: Initial advisory published by Vercel
2026-05-15: disclosed: CVE-2026-45773 published to NVD
2026-05-19: patched: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.