npm

rollup

Security advisories for rollup, newest first. 1 known, all fixed. If you’re on 3.30.0 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

4.66.0

Advisories

1 · 0 unfixed

Last advisory

25 Feb 2026

Safe from

3.30.0

1 advisory · newest first

HIGH 25 Feb 2026

Rollup 4 has Arbitrary File Write via Path Traversal

GHSA-mw96-cpmx-2vgc · CVE-2026-27606

Affected

< 2.80.0 ≥ 3.0.0, < 3.30.0

Fixed in

2.80.0 3.30.0

Published

25 Feb 2026

/advisories/npm/rollup/feed.rss

From the GitHub advisory database, via OSV · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →