PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` - @powersync/service-core

Description

In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users.

Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted.

Recommendation

Update the @powersync/service-core package to the latest compatible version. Followings are version details:

• Affected version(s): = 1.20.0
• Patched version(s): 1.20.1

References

• GHSA-q6wc-xx4m-92fj
• CVE-2026-30870
• CWE-285
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` - CVE-2026-30870
• Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957
• Angular Expressions - Remote Code Execution using filters - CVE-2026-44643
• devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse - CVE-2026-22775

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@powersync/service-core