Uptime Kuma

Monitoring · products/uptime-kuma.yaml · RSS

Latest 2.5.7 Oct 23, 2026

Recent releases

2.5.7 Oct 23, 2026 Release notes ↗ 1fix1security

security[Docker] Images bumped to Node.js 22.23.4, now it rejects the leaked eMudhra 384 bit CA: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:04. (Thanks @veteranbv)

2.5.6 Oct 9, 2026 → 2.5.7 Release notes ↗ 1fix1security

security#7858 chore: Update dependencies

2.5.5 Sep 16, 2026 → 2.5.7 Release notes ↗ 1fix

2.5.4 Sep 11, 2026 → 2.5.7 Release notes ↗ 6feature5fix2security

security#7838 fix: bump jsonata to 2.2.2 (CVE-2026-77415) (Thanks @Fierygit @cursoragent)

securityGHSA-wf2j-5mc7-5c4w DoS weakness

2.5.3 Aug 22, 2026 → 2.5.7 Release notes ↗ 1fix

2.5.2 Aug 22, 2026 → 2.5.7 Release notes ↗ 1fix

2.5.1 Aug 22, 2026 → 2.5.7 Release notes ↗ 7feature2fix

2.5.0 Aug 1, 2026 → 2.5.7 Release notes ↗ 13feature14fix2security1breaking

security#7538 #7349 chore: Update dependencies

security#7508 chore: Set 14 days cooldown for npm update to mininize the supply-chain-attack

breaking#7535 chore: Remove meaningless entries from en.json

2.4.0 May 31, 2026 → 2.5.7 Release notes ↗ 8feature3fix1security

security(Admin only/Authenticated only) Fix: LiquidJS is Vulnerable to Remote Code Execution, a vulnerability from an upstream dependency. In Uptime Kuma, LiquidJS should be used in notification template. (https://github.com/advisories/GHSA-gf2q-c269-pqgc)

2.3.2 May 3, 2026 → 2.5.7 Release notes ↗ 1fix

2.3.1 May 3, 2026 → 2.5.7 Release notes ↗ 1fix

2.3.0 May 1, 2026 → 2.5.7 Release notes ↗ 6breaking13feature8fix

breaking#7194 fix: Revert "add sorting to status pages"

breakingNo more sorting feature in status pages.

breakingDue to bad performance.

2.2.1 Mar 10, 2026 → 2.5.7 Release notes ↗ 2feature4fix1security

securityGHSA-v832-4r73-wx5j - Another Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read (fixed in upstream dependency LiquidJS, also see: https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x)

2.2.0 Mar 5, 2026 → 2.5.7 Release notes ↗ 5feature13fix1security1breaking

securityGHSA-c7hf-c5p5-5g6h Missing Authorization Check on Ping Badge Endpoint Leaks Ping times of montors (Thanks @kuranikaran)

breaking#7032 chore: remove @aws-sdk, @azure packages

2.1.3 Feb 19, 2026 → 2.5.7 Release notes ↗ 1fix

Security advisories

7.5 GHSA-wf2j-5mc7-5c4w Unauthenticated resource exhaustion DoS in ping badge endpoint via arbitrary monitor IDs

6.5 CVE-2026-33130 Another Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read

5.3 CVE-2026-32230 Missing Authorization Check on Ping Badge Endpoint Leaks Ping times of montors without needing to be on a status page

low GHSA-9fg7-wgm7-57fh RSS status feed does not set content type, leading to a Stored XSS in Public Status Page RSS Feed via CDATA escaped Monitor Name IF USING AN UNSECURE CLIENT

6.5 GHSA-vffh-c9pq-4crh Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read

5.2 GHSA-qjxc-h5jf-c7rj GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accounts in uptime kuma

7.5 GHSA-5px6-fx2w-459r Unauthenticated file read of files that begin with `index.`

6.7 GHSA-hx7h-9vf7-5xhg Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

6.8 CVE-2024-56331 Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor

low GHSA-23q2-5gf8-gjpp Enabling Authentication does not close all logged in socket connections immediately

6.7 CVE-2023-49804 Changing Password does not close all logged in socket connections immediately

6.0 CVE-2023-49805 Missing Origin Validation in WebSockets

medium GHSA-hfxh-rjv7-2369 Authenticated remote code execution via TailscalePing

6.3 CVE-2023-49276 Attribute Injection leading to XSS(Cross-Site-Scripting)

6.7 CVE-2023-44400 Persistentent User Sessions

6.5 CVE-2023-36822 Authenticated path traversal via plugin repository name leading to unavailability or data loss

8.8 CVE-2023-36821 Authenticated remote code execution via malicious plugin installation

6.3 CVE-2023-25811 Persistent XSS through "new status page --> name"

6.3 CVE-2023-25810 Persistent XSS through description in status page

Recent releases

Security advisories

Sources