Cairn
NousResearch/hermes-agent

WhatsApp Baileys dependency security vulnerability updates

Cluster 43814 · gateway. Data as of

Nothing open on GitHub. Fix attempted, not merged.

The short answer

0open issues
0open PRs
4items grouped
Known?
Yes. 4 related items grouped here, 2 issues already closed.
Fix event
No fix has been merged to main. 2 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
Nothing open on GitHub.

These issues and pull requests concern a critical CVE (GHSA-qvv5-jq5g-4cgg) in the @whiskeysockets/baileys library used by the WhatsApp bridge, with various efforts to bump the dependency to patched release candidates (rc12/rc13).

Open issues0

No open issues.

Open PRs0

No open pull requests.

2 PRs closed without merging

From the close comments: superseded by another PR 1 · other 1

  • #43815 fix(whatsapp-bridge): bump Baileys to 7.0.0-rc12 for CVE-2026-48063 · superseded by another PR → #43840
  • #44980 chore(whatsapp-bridge): npm audit fix + bump Baileys to patched release (5 of 5 vulns) · other → c30c975, #60643, #43814
Closed issues · 2
  • Closed#43814fix(whatsapp-bridge): bump Baileys to >=7.0.0-rc12 for CVE-2026-48063 (GHSA-qvv5-jq5g-4cgg)
  • Closed#44983WhatsApp bridge: critical CVE in @whiskeysockets/baileys (GHSA-qvv5-jq5g-4cgg)
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.39: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
gateway
Closed issues
2
Attempts
2 PRs closed without merging

For your agent

The same facts, typed.

cluster/43814.json
cluster/43814.md