Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-48063 · CVE overview and exploitation status

EUVD-2026-52440

GHSA-qvv5-jq5g-4cgg

cve-program · CVE-2026-48063

• https://github.com/WhiskeySockets/Baileys/security/advisories/GHSA-qvv5-jq5g-4cgg
• https://github.com/WhiskeySockets/Baileys/commit/3beb08eecfcb4e65722e674034bd84fb11a9de35

euvd · EUVD-2026-52440

• https://github.com/WhiskeySockets/Baileys/security/advisories/GHSA-qvv5-jq5g-4cgg
• https://github.com/WhiskeySockets/Baileys/commit/3beb08eecfcb4e65722e674034bd84fb11a9de35

nvd · CVE-2026-48063

• https://github.com/WhiskeySockets/Baileys/commit/3beb08eecfcb4e65722e674034bd84fb11a9de35
• https://github.com/WhiskeySockets/Baileys/security/advisories/GHSA-qvv5-jq5g-4cgg

osv · GHSA-qvv5-jq5g-4cgg

• https://github.com/WhiskeySockets/Baileys/security/advisories/GHSA-qvv5-jq5g-4cgg
• https://github.com/WhiskeySockets/Baileys/commit/3beb08eecfcb4e65722e674034bd84fb11a9de35
• https://github.com/WhiskeySockets/Baileys

No related changes are available here.