centrifugo
v6.10.3Scalable real-time messaging server in a language-agnostic way. Self-hosted alternative to Pubnub, Pusher, Ably, socket.io, Phoenix.PubSub, SignalR. Set up once and forever.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 11 advisories2 critical, 3 high, 3 medium, 3 low · Scorecard 5.6/10
- Supported versions
- No scheduleendoflife.date does not track this project
11k stars · 754 forks · 35 open issues · last release 6 days ago · data checked 5 hours ago
Security advisories
All advisories on GitHubThe 11 most recent advisories published by the maintainers: 2 critical, 3 high, 3 medium, 3 low. Check the patched version against the one you run.
- mediumGHSA-xcch-wm46-g65gSep 29, 2026Deadlock between recovery buffer and hub shard lock lets a client stop a hub shard (denial of service)
- Affected
- <= 0.39.2
- Patched in
- 0.39.3
- mediumGHSA-8w47-3f5r-h9xmAug 18, 2026No rate limiting or lockout on admin password authentication endpoint (POST /admin/auth)
- Affected
- <= 6.9.1
- Patched in
- 6.9.2
- lowGHSA-98cg-m2cg-6xprAug 18, 2026Malicious/compromised server crashes any embedding application via malformed Reply frame (centrifugal/centrifuge-go dependency)
- Affected
- <= 0.12.0
- Patched in
- 0.12.1
- criticalGHSA-4r3x-2rwr-6w65Aug 18, 2026Unauthenticated remote crash via unbounded length-prefix in protobuf stream decoder (centrifugal/protocol dependency)
- Affected
- <= 0.19.2
- Patched in
- 0.21.0
- lowGHSA-v4h4-9j4c-ghgpJul 13, 2026Administrator tokens are transmitted via URL query parameters, posing a risk of credential leakage
- Affected
- <=6.9.0
- Patched in
- 6.9.1
- highCVE-2026-71485Jul 7, 2026Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
- Affected
- <= 6.8.4
- Patched in
- 6.9.0
- highCVE-2026-62963Jun 30, 2026Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport
- Affected
- <= 6.8.3
- Patched in
- 6.8.4
- highCVE-2026-49998May 27, 2026Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass
- Affected
- <= 6.8.0
- Patched in
- 6.8.1
- lowGHSA-q926-c743-49qjMar 12, 2026InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning
- Affected
- <= 6.6.2
- Patched in
- 6.7.0
- criticalCVE-2026-32301Mar 12, 2026SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
- Affected
- <= 6.6.2
- Patched in
- 6.7.0
- mediumGHSA-j9wf-6r2x-hqmxFeb 19, 2026Centrifugo v6.6.0 dependency vulnerabilities
- Affected
- <6.6.1
- Patched in
- 6.6.1