Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Alist has Insecure TLS Config

Fix availableCritical · CVSS 9.1EPSS 0.25%

Published Feb 4, 2026 · updated Oct 8, 2026

What to do

  1. Upgrade to a fixed version: github.com/alist-org/alist/v3 3.57.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/alist-org/alist/v3

Vulnerable versions
< 3.57.0
Fixed in
3.57.0

Check your project: go list -m all | grep github.com/alist-org/alist/v3

Sources

CWE-295 Improper Certificate Validation

← All critical vulnerabilities