critical vulnerability

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Partly patchedCritical · CVSS 9.3EPSS 0.21%

Published Oct 5, 2026 · updated Oct 5, 2026

What to do

Upgrade to a fixed version: @capacitor/android 6.2.2, @capacitor/android 7.6.9, @capacitor/ios 6.2.2, @capacitor/ios 7.6.9 (see table).
Some affected packages have no fixed version yet: follow the advisory for mitigations and watch this page for the fix.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npm@capacitor/android

Vulnerable versions: >= 6.0.0, < 6.2.2
Fixed in: 6.2.2

Check your project: npm ls @capacitor/android --all

Is @capacitor/android@6.2.2 safe to install? See the upgrade verdict →

npm@capacitor/android

Vulnerable versions: >= 7.0.0, < 7.6.9
Fixed in: 7.6.9

Check your project: npm ls @capacitor/android --all

Is @capacitor/android@7.6.9 safe to install? See the upgrade verdict →

npm@capacitor/ios

Vulnerable versions: >= 6.0.0, < 6.2.2
Fixed in: 6.2.2

Check your project: npm ls @capacitor/ios --all

Is @capacitor/ios@6.2.2 safe to install? See the upgrade verdict →

npm@capacitor/ios

Vulnerable versions: >= 7.0.0, < 7.6.9
Fixed in: 7.6.9

Check your project: npm ls @capacitor/ios --all

Is @capacitor/ios@7.6.9 safe to install? See the upgrade verdict →

Swiftgithub.com/ionic-team/capacitor-swift-pm

Vulnerable versions: >= 6.0.0, < 6.2.2
Fixed in: 6.2.2

Check your project: swift package show-dependencies | grep github.com/ionic-team/capacitor-swift-pm

Swiftgithub.com/ionic-team/capacitor-swift-pm

Vulnerable versions: >= 7.0.0, < 7.6.9
Fixed in: 7.6.9

Check your project: swift package show-dependencies | grep github.com/ionic-team/capacitor-swift-pm

Mavencom.capacitorjs:core

Vulnerable versions: >= 6.0.0, < 6.2.2
Fixed in: 6.2.2

Check your project: mvn dependency:tree -Dincludes=com.capacitorjs:core

Mavencom.capacitorjs:core

Vulnerable versions: >= 7.0.0, < 7.6.9
Fixed in: 7.6.9

Check your project: mvn dependency:tree -Dincludes=com.capacitorjs:core

npm@capacitor/android

Vulnerable versions: >= 8.5.0, < 8.5.1
Fixed in: 8.5.1

Check your project: npm ls @capacitor/android --all

Is @capacitor/android@8.5.1 safe to install? See the upgrade verdict →

npm@capacitor/ios

Vulnerable versions: >= 8.5.0, < 8.5.1
Fixed in: 8.5.1

Check your project: npm ls @capacitor/ios --all

Is @capacitor/ios@8.5.1 safe to install? See the upgrade verdict →

Swiftgithub.com/ionic-team/capacitor-swift-pm

Vulnerable versions: >= 8.5.0, < 8.5.1
Fixed in: 8.5.1

Check your project: swift package show-dependencies | grep github.com/ionic-team/capacitor-swift-pm

Mavencom.capacitorjs:core

Vulnerable versions: >= 8.5.0, < 8.5.1
Fixed in: 8.5.1

Check your project: mvn dependency:tree -Dincludes=com.capacitorjs:core

Mavencom.capacitorjs:core

Vulnerable versions: >= 8.3.5, < 8.4.3
Fixed in: 8.4.3

Check your project: mvn dependency:tree -Dincludes=com.capacitorjs:core

npm@capacitor/android

Vulnerable versions: >= 8.3.5, < 8.4.3
Fixed in: 8.4.3

Check your project: npm ls @capacitor/android --all

Is @capacitor/android@8.4.3 safe to install? See the upgrade verdict →

npm@capacitor/ios

Vulnerable versions: >= 8.3.5, < 8.4.3
Fixed in: 8.4.3

Check your project: npm ls @capacitor/ios --all

Is @capacitor/ios@8.4.3 safe to install? See the upgrade verdict →

Swiftgithub.com/ionic-team/capacitor-swift-pm

Vulnerable versions: >= 8.3.5, < 8.4.3
Fixed in: 8.4.3

Check your project: swift package show-dependencies | grep github.com/ionic-team/capacitor-swift-pm

Swiftgithub.com/ionic-team/capacitor-swift-pm

Vulnerable versions: >= 8.0.0, <= 8.3.4
Fixed in: no fix yet

Check your project: swift package show-dependencies | grep github.com/ionic-team/capacitor-swift-pm

Mavencom.capacitorjs:core

Vulnerable versions: >= 8.0.0, <= 8.3.4
Fixed in: no fix yet

Check your project: mvn dependency:tree -Dincludes=com.capacitorjs:core

npm@capacitor/android

Vulnerable versions: >= 8.0.0, <= 8.3.4
Fixed in: no fix yet

Check your project: npm ls @capacitor/android --all

npm@capacitor/ios

Vulnerable versions: >= 8.0.0, <= 8.3.4
Fixed in: no fix yet

Check your project: npm ls @capacitor/ios --all

Sources

CWE-346 Origin Validation Error · CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')

← All critical vulnerabilities