Contact us
Start building

Security

Vaadin is committed to resolving vulnerabilities to meet the needs of its customers and the broader technology community. This page describes Vaadin's policy for receiving reports related to potential security vulnerabilities in its products and services and the company's standard practice with regards to informing customers of verified vulnerabilities.

When to contact the security emergency response team

Contact the Vaadin Product Security Incident Response Team (PSIRT) by sending email to security@vaadin.com in the following situations:

  • You have identified a potential security vulnerability with one of our products;
  • You have identified a potential security vulnerability with one of our services.

To ensure confidentiality, we encourage you to encrypt any sensitive information you send to us via email. We are equipped to receive messages encrypted using S/MIME. You can download a copy of the certificate that can be used to send encrypted email to us: security_vaadin_com.p7b.

The security@vaadin.com email address is intended only for reporting product or service security vulnerabilities — not for technical support. All other content will be dropped. For technical and customer support inquiries, please use our Forum or create an issue in the corresponding GitHub repository.

Vaadin PSIRT will confirm receipt of your report within three business days. We will work with internal teams to verify the finding and respond in a timely manner with an update or request for additional information.

Receiving security information from Vaadin

Technical security information about our products and services is distributed through several channels.

Vaadin distributes information to customers about security vulnerabilities via this vaadin.com/security page, GitHub security advisories (where applicable) and by email to registered users. In most cases, we will issue a notice when we have identified a practical workaround or fix for the particular security vulnerability, though there can be instances when we issue a notice in the absence of a workaround when the vulnerability has become widely known to the security community. As each security vulnerability case is different, we can take alternative actions in connection with issuing security notices. Vaadin does not guarantee that security notices will be issued for any or all security issues customers consider significant, or that notices will be issued on any specific timetable.

Security-related information can also be distributed by Vaadin to public newsgroups or electronic mailing lists on a case-by-case basis, depending on the relevance of each notice to each particular forum.

Vaadin works with the formal incident response community to distribute information. Many company security notices are distributed by regional CSIRT at the same time that they are sent through company information distribution channels.

All aspects of this process are subject to change without notice, as well as to case-by-case exceptions. No particular level of response is guaranteed for any specific issue or class of issues.

Vulnerability reports

Date 2026-10-27 Severity Low Reference CVE-2026-110737 Description Push endpoint returns permissive CORS headers
Date 2026-10-23 Severity Notice Reference ADVISORY-2026-10-23 Description Vaadin and the October 2026 Node.js security releases
Date 2026-10-23 Severity Notice Reference ADVISORY-2026-10-23 Description No version of Vaadin uses PHP
Date 2026-10-21 Severity High Reference CVE-2026-110803 Description Session lock leak on an invalid UI id allows DoS in Vaadin 8
Date 2026-10-21 Severity High Reference CVE-2026-107588 Description Multiple vulnerabilities in the Highcharts library bundled with Vaadin Charts
Date 2026-09-30 Severity Medium Reference CVE-2026-91860 Description Prototype pollution in chart configuration and component i18n
Date 2026-09-30 Severity Medium Reference CVE-2026-93547 Description Missing sheet protection check when updating cell comments
Date 2026-05-19 Severity Low Reference CVE-2026-7860 Description Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build
Date 2026-04-17 Severity Notice Reference ADVISORY-2026-04-17 Description Vaadin Flow and the axios npm supply-chain compromise
Date 2026-03-10 Severity Medium Reference CVE-2026-2742 Description Unauthorized Session Creation via Reserved Framework Path Access
Date 2026-03-10 Severity Low Reference CVE-2026-2741 Description Zip Slip Path Traversal on Node Unpack
Date 2026-01-05 Severity Medium Reference CVE-2025-15022 Description Cross-site scripting in Action caption
Date 2025-12-09 Severity Notice Reference ADVISORY-2025-12-09 Description React 19 Server Components Critical Vulnerability (CVE-2025-55182, CVE-2025-55183, CVE-2025-55184)
Date 2025-09-26 Severity Notice Reference ADVISORY-2025-09-26 Description Vaadin Flow, Hilla and the September 2025 npm supply-chain attacks
Date 2025-09-03 Severity Medium Reference CVE-2025-9467 Description Possibility to bypass file upload validation on the server-side
Date 2025-03-31 Severity Critical Reference ADVISORY-2025-03-31 Description Ingress-Nginx Admission Controller RCE Escalation
Date 2023-06-22 Severity Notice Reference CVE-2023-25499 Description Possible information disclosure in non visible components
Date 2023-06-22 Severity High Reference ADVISORY-2023-06-22 Description Apache Commons FileUpload - DoS with excessive parts
Date 2023-06-22 Severity Low Reference CVE-2023-25500 Description Possible information disclosure of class and method names in RPC response
Date 2022-05-24 Severity Medium Reference CVE-2022-29567 Description Possible information disclosure inside TreeGrid component with default data provider
Date 2022-04-01 Severity Critical Reference ADVISORY-2022-04-01 Description Spring Core Remote Code Execution via Data Binding on JDK 9+
Date 2021-11-01 Severity Medium Reference CVE-2021-33611 Description Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14
Date 2021-10-27 Severity High Reference ADVISORY-2021-10-27 Description Denial of service in third-party component in Vaadin 7 and 8
Date 2021-10-13 Severity Medium Reference CVE-2021-33609 Description Denial of service in DataCommunicator class in Vaadin 8
Date 2021-08-24 Severity Medium Reference CVE-2021-33605 Description Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
Date 2021-06-24 Severity Low Reference CVE-2021-33604 Description Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19
Date 2021-06-24 Severity Medium Reference CVE-2021-31412 Description Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Date 2021-05-04 Severity Medium Reference CVE-2021-31411 Description Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
Date 2021-04-30 Severity High Reference CVE-2021-31409 Description Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
Date 2021-04-22 Severity High Reference CVE-2021-31410 Description Project sources exposure in Vaadin Designer
Date 2021-04-20 Severity Medium Reference CVE-2021-31408 Description Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Date 2021-03-29 Severity High Reference CVE-2021-31407 Description Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
Date 2021-03-19 Severity Medium Reference CVE-2021-31406 Description Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Date 2021-03-11 Severity High Reference CVE-2021-31405 Description Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Date 2021-02-17 Severity Medium Reference CVE-2021-31404 Description Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18
Date 2021-02-12 Severity Medium Reference CVE-2021-31403 Description Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8
Date 2020-11-26 Severity Medium Reference CVE-2020-36321 Description Directory traversal in development mode handler in Vaadin 14 and 15-17
Date 2020-10-08 Severity High Reference CVE-2020-36320 Description Regular expression denial of service (ReDoS) in EmailValidator class in Vaadin 7
Date 2020-04-21 Severity Low Reference CVE-2020-36319 Description Potential sensitive data exposure in applications using Vaadin 15
Date 2019-07-04 Severity Medium Reference CVE-2019-25028 Description Stored cross-site scripting in Grid component in Vaadin 7 and 8
Date 2019-05-27 Severity Medium Reference CVE-2019-25027 Description Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Date 2018-11-29 Severity Low Reference CVE-2018-25007 Description Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Date 2018-11-13 Severity Notice Reference ADVISORY-2018-11-13 Description Potential deserialization of untrusted data in Vaadin 7 and 8 when JMX or RMI are enabled
Date 2017-05-11 Severity High Reference ADVISORY-2017-05-11 Description Denial of service in UIDL request handler in Vaadin 7 and 8