CVE-2023-50728: octokit/webhooks is a GitHub webhook events toolset for Node.js

Routine

MEDIUM 5.4DOWNGRADEUPGRADEUPGRADE

CVE-2023-50728 is a medium-severity flaw (CVSS 5.4) affecting app, octokit, webhooks. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

octokit/webhooks is a GitHub webhook events toolset for Node.js. Starting in 9.26.0 and prior to 9.26.3, 10.9.2, 11.1.2, and 12.0.4, there is a problem caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases. The resulting request was found to cause an uncaught exception that ends the nodejs process. The bug is fixed in octokit/webhooks.js 9.26.3, 10.9.2, 11.1.2, and 12.0.4, app.js

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	5.4 (Medium)
Attack vector	Adjacent network
Attack complexity	High
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.9% (top 40%)
CISA exploited list	No
Weakness	CWE-755
Published	2023-12-15
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: octokit · probot

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-12-15 22:15 UTCPublished CVE record published
2026-06-17 06:39 UTCUpdated Record last modified

octokit app DOWNGRADE

Affected: 14.0.1

Fixed in: no fixed release known

Safe to downgrade to: a release before 14.0.1

1. Check installed version

npm ls app

2. No fixed release: DOWNGRADE to a release before 14.0.1

npm view app versions npm install app@"<14.0.1"

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

octokit octokit UPGRADE

Affected: < 3.1.2

Fixed in: 3.1.2

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls octokit

2. UPGRADE to 3.1.2

npm install octokit@">=3.1.2"

octokit webhooks UPGRADE

Affected: < 9.26.3 · >= 10.0.0 and < 10.9.2 · >= 11.0.0 and < 11.1.2 · >= 12.0.0 and < 12.0.4

Fixed in: 9.26.3, 10.9.2, 11.1.2, 12.0.4

Safe to downgrade to: a release before 10.0.0

1. Check installed version

npm ls webhooks

2. UPGRADE to 9.26.3

npm install webhooks@">=9.26.3"

3. If no update is available yet, DOWNGRADE to a release before 10.0.0

npm view webhooks versions npm install webhooks@"<10.0.0"

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

probot probot UPGRADE

Affected: < 12.3.3

Fixed in: 12.3.3

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls probot

2. UPGRADE to 12.3.3

npm install probot@">=12.3.3"

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-50728?

app: downgrade or apply the listed mitigation; octokit: upgrade to 3.1.2; webhooks: upgrade to 9.26.3, 10.9.2, 11.1.2, 12.0.4. Exact commands for each OS are on this page.

Is CVE-2023-50728 being exploited?

CVE-2023-50728 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-50728 affect?

CVE-2023-50728 affects app, octokit, webhooks. Severity is medium (CVSS 5.4). octokit/webhooks is a GitHub webhook events toolset for Node.js. Starting in 9.26.0 and prior to 9.26.3, 10.9.2, 11.1.2, and 12.0.4, there is a problem caused by an issue with error handling in the @octokit/webhooks library because the erro

How urgent is CVE-2023-50728?

Priority 34/100. No elevated risk signals yet.

Software pages

Node.js vulnerabilities · GitHub vulnerabilities

Related CVEs

CVE-2020-36533 LOW 3.7 MITIGATE A vulnerability was found in Klapp App and classified as problematic
CVE-2020-36532 MEDIUM 4.3 MITIGATE A vulnerability has been found in Klapp App and classified as problematic

References

← Back to latest CVEs