Package vulnerability, severity high

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

Published October 30, 2026, updated October 31, 2026

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location. Source: GHSA-j63v-mwhm-56jx (CVE-2026-118763).

What's affected

• @sigstore/oci (npm)<0.7.2

What to do

1. Upgrade @sigstore/oci to 0.7.2 or later.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-j63v-mwhm-56jx

References

• https://osv.dev/vulnerability/GHSA-j63v-mwhm-56jx
• https://github.com/sigstore/sigstore-js/security/advisories/GHSA-j63v-mwhm-56jx
• https://nvd.nist.gov/vuln/detail/CVE-2026-118763
• https://github.com/sigstore/sigstore-js/pull/1762
• https://github.com/sigstore/sigstore-js/commit/b855f46cfe81f26481c6d3f4b333dfd00f2fd1b1
• https://github.com/sigstore/sigstore-js/commit/e4ca65c3ab3c675456ab9b0bd04217ceccad3558
• https://github.com/sigstore/sigstore-js
• https://github.com/sigstore/sigstore-js/releases/tag/@sigstore/oci@0.7.2

Notice ghsa-j63v-mwhm-56jx, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.