ZeroDay Findings
Sign inSign up

Findings

CVE-2026-50288

SpecifyJS is a declarative TypeScript user interface framework.

Published Aug 21, 2026 · updated Oct 14, 2026

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when throws a parse error, the function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 21, 2026 · NIST NVD

    Detected

    SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when throws a parse error, the function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.

  2. Oct 14, 2026 · NIST NVD

    Updated

    SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when throws a parse error, the function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.

Sources

  • CVE.orgVulnerability recordCVE-2026-50288

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-50288

    30-day exploitation probability 0.5%

    first.org
  • NIST NVDVulnerability recordCVE-2026-50288

    SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when throws a parse error, the function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.13

    nvd.nist.gov

References