Changes.Watch~ upgrade verdicts ~
Free digest
Research1 in 10 popular npm releases needed a hotfix

critical vulnerability

Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto

Fix availableCritical · CVSS 9.3EPSS 1.4%

Published Jun 24, 2026 · updated Nov 3, 2026

What to do

  1. Upgrade to a fixed version: feast 0.63.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIfeast66,168 downloads/week

Vulnerable versions
< 0.63.0
Fixed in
0.63.0

Check your project: pip show feast

Sources

CWE-502 Deserialization of Untrusted Data

← All critical vulnerabilities