github.com/prebid/prebid-server/v4
Open-source solution for running real-time advertising auctions in the cloud.
View on Github
Activity
- Latest release
- 2w ago
- Total releases
- 10
- Cadence
- ~14 days
- Last 12 months
- 10
Reach
- Stars
- 572
Details
- First release
- Mar 05, 2026
| Version | Released | |
|---|---|---|
v4.9.0
minor
|
v4.9.0
minor
Dependencies (42)
+ 34 more |
|
v4.8.0
minor
|
v4.8.0
minor
Dependencies (42)
+ 34 more |
|
v4.7.0
minor
|
v4.7.0
minor
Dependencies (42)
+ 34 more |
|
v4.6.0
minor
|
v4.6.0
minor
Dependencies (42)
+ 34 more |
|
v4.5.0
minor
|
v4.5.0
minor
Dependencies (42)
+ 34 more |
|
v4.4.0
minor
|
v4.4.0
minor
Dependencies (42)
+ 34 more |
|
v4.3.0
minor
1 CVE
CVE-2026-54735
GO-2026-6139
GHSA-4p3g-4hcj-wpvx
Aug 18, 2026
Server-side request forgery in bidder adapters in github.com/prebid/prebid-server/v4 In github.com/prebid/prebid-server/v4 before 4.4.0, multiple bidder adapters (acuityads, bidmachine, relevantdigital, smartyads, tappx, trafficgate, zeroclickfraud) interpolate user-supplied host and subdomain parameters into outbound request URLs without validation. A remote attacker can craft bid request parameters containing path traversals or target addresses to trigger server-side request forgery (SSRF), sending HTTP requests to internal network services or unintended endpoints. Fixed in
4.4.0
References Updated Aug 18, 2026 · Source: OSV.dev |
v4.3.0
minor
Dependencies (42)
+ 34 more |
|
v4.2.0
minor
1 CVE
CVE-2026-54735
GO-2026-6139
GHSA-4p3g-4hcj-wpvx
Aug 18, 2026
Server-side request forgery in bidder adapters in github.com/prebid/prebid-server/v4 In github.com/prebid/prebid-server/v4 before 4.4.0, multiple bidder adapters (acuityads, bidmachine, relevantdigital, smartyads, tappx, trafficgate, zeroclickfraud) interpolate user-supplied host and subdomain parameters into outbound request URLs without validation. A remote attacker can craft bid request parameters containing path traversals or target addresses to trigger server-side request forgery (SSRF), sending HTTP requests to internal network services or unintended endpoints. Fixed in
4.4.0
References Updated Aug 18, 2026 · Source: OSV.dev |
v4.2.0
minor
Dependencies (42)
+ 34 more |
|
v4.1.0
minor
1 CVE
CVE-2026-54735
GO-2026-6139
GHSA-4p3g-4hcj-wpvx
Aug 18, 2026
Server-side request forgery in bidder adapters in github.com/prebid/prebid-server/v4 In github.com/prebid/prebid-server/v4 before 4.4.0, multiple bidder adapters (acuityads, bidmachine, relevantdigital, smartyads, tappx, trafficgate, zeroclickfraud) interpolate user-supplied host and subdomain parameters into outbound request URLs without validation. A remote attacker can craft bid request parameters containing path traversals or target addresses to trigger server-side request forgery (SSRF), sending HTTP requests to internal network services or unintended endpoints. Fixed in
4.4.0
References Updated Aug 18, 2026 · Source: OSV.dev |
v4.1.0
minor
Dependencies (42)
+ 34 more |
|
v4.0.0
initial
1 CVE
CVE-2026-54735
GO-2026-6139
GHSA-4p3g-4hcj-wpvx
Aug 18, 2026
Server-side request forgery in bidder adapters in github.com/prebid/prebid-server/v4 In github.com/prebid/prebid-server/v4 before 4.4.0, multiple bidder adapters (acuityads, bidmachine, relevantdigital, smartyads, tappx, trafficgate, zeroclickfraud) interpolate user-supplied host and subdomain parameters into outbound request URLs without validation. A remote attacker can craft bid request parameters containing path traversals or target addresses to trigger server-side request forgery (SSRF), sending HTTP requests to internal network services or unintended endpoints. Fixed in
4.4.0
References Updated Aug 18, 2026 · Source: OSV.dev |
v4.0.0
initial
Dependencies (41)
+ 33 more |