npm package
rollup vulnerabilities by version
The latest release, 4.64.7 (Oct 15, 2026), has no known vulnerabilities. 24% of last week’s 126.1M downloads went to versions with known vulnerabilities. OSV.dev lists 2 advisories for rollup; the newest was published on Feb 25, 2026.
npm (opens in a new tab) describes it as “Next-generation ES module bundler”
- Latest release
- 4.64.7
- Oct 15, 2026, no known vulnerabilities
- Downloads last week
- 126.1M
- All versions, from npm
- Advisories on OSV.dev
- 2
- Newest Feb 25, 2026
- Licence
- MIT
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable rollup
24% of last week’s 126.1M rollup downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Release lines
The newest release of each major line, from the registry. rollup doesn’t publish support dates we can check.
Newest advisories
The 2 most recently published, with the versions each one affects.
CriticalCVE-2026-27606 on OSV.dev (opens in a new tab)GHSA-mw96-cpmx-2vgc
Rollup 4 has Arbitrary File Write via Path Traversal
Affects < 2.80.0; >= 3.0.0, < 3.30.0; >= 4.0.0, < 4.59.0. Published Feb 25, 2026.
CriticalCVE-2024-47068 on OSV.dev (opens in a new tab)GHSA-gcx4-mw62-g8wm
DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
Affects >= 3.0.0, < 3.29.5; >= 4.0.0, < 4.22.4; < 2.79.2. Published Sep 23, 2024.
Which rollup do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for rollup, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.