Information Disclosure via Flags override link

Description

An information disclosure vulnerability affecting Flags SDK has been addressed. It impacted flags ≤3.2.0 and @vercel/flags ≤3.1.1 and in certain circumstances, allowed a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint (.well-known/vercel/flags).

Recommendation

No fix is available yet. Followings are affected versions:

• <= 3.1.1

References

• GHSA-892p-pqrr-hxqr
• vercel.com
• CVE-2025-46332
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Information Disclosure via Flags override link - flags - CVE-2025-46332
• PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments - CVE-2026-45623
• Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint - CVE-2025-48996
• Trix allows Cross-site Scripting via `javascript:` url in a link - CVE-2025-21610

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@vercel/flags