Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 17 August 2026.

Which products and versions are affected?

ep_etherpad-lite (npm) SEMVER:introduced=0,fixed=3.3.0.

Is there a fix for This vulnerability?

Yes. ep_etherpad-lite (npm): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Etherpad multiple security hardening fixes

Severity: info · Published 2026-08-17

Etherpad is a real-time collaborative text editor used in numerous organizations for shared document editing. This advisory addresses six security hardening improvements including weak random number generation for session tokens, login timing vulnerabilities, and API parameter pollution. While individually moderate-severity issues, these fixes collectively reduce attack surface and improve the platform's resilience against token prediction, credential attacks, and unauthorized API manipulation.

Technologies: ep_etherpad-lite (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 17 August 2026.
Which products and versions are affected?: ep_etherpad-lite (npm) SEMVER:introduced=0,fixed=3.3.0.
Is there a fix for This vulnerability?: Yes. ep_etherpad-lite (npm): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ep_etherpad-lite (npm): upgrade to 3.3.0 or later
```
npm install ep_etherpad-lite@3.3.0
```

Technical details

The advisory covers six distinct vulnerability classes: (1) weak RNG for session/author/readonly tokens using Math.random() instead of cryptographic randomness (CWE-330), (2) non-constant-time password comparison in OIDC login without failure delay (CWE-208/307), (3) insufficient validation of plugin dependency paths from package.json allowing path traversal (CWE-22), (4) API parameter pollution via header merging into /api/2 field set (CWE-235), (5) unintended pad creation via API.appendChatMessage (missing getPadSafe), and (6) error message information disclosure in admin file server (CWE-209). All are admin-gated or require prior authentication except token generation. Patches are included in version 3.3.0 released in June 2026.

Affected products

Etherpad Etherpad <= 3.2.0

Timeline

2026-08-17: disclosed
2026-06-10: patched: PR #7906 merged; fix available in version 3.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.