Prebid vulnerabilities
We track 4 vulnerabilities in Prebid products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest Prebid vulnerabilities
- 10.0 Critical severity
prebid-server-java: Server-Side Request Forgery
Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can
- 10.0 Critical severity
prebid-server: Server-Side Request Forgery
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host
- 9.3 Critical severity
prebid-universal-creative: Embedded Malicious Code
Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unp
- 8.6 High severity
Prebid.js: Embedded Malicious Code
Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the a