PatchTheCVEfzf vulnerabilities and fixes
Recent CVEs affecting fzf, with upgrade or downgrade steps. 2 tracked.
fzf has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-06-30. Highest priority: CVE-2026-53432 (score 40/100).
- CVE-2026-53433 HIGH 7.5 UPGRADE fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode du
- CVE-2026-53432 HIGH 7.5 UPGRADE fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function
FAQ
How do I fix fzf vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fzf being exploited right now?
None of the tracked fzf CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fzf CVE should I patch first?
CVE-2026-53432 currently ranks highest (40/100): fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function.