@backstage/backend-defaults (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package @backstage/backend-defaults, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2026-24046 — CVSS 7.1 (high): Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable…
• CVE-2026-24048 — CVSS 3.5 (low): Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and…