CVE-2026-48063 Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
Attackers can spoof messages and corrupt app state in Baileys sessions by sending malicious protocol message payloads, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48063?
CVE-2026-48063 is a critical vulnerability in @whiskeysockets/baileys, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to spoof messages. The same exploit also allows an attacker to corrupt the app state sync system by sending fake key shares, and also allows for history sync spoofing which also serves the same problem, injecting fake previous context or "on-demand" sync. This issue has been fixed in versions 6.7.22 and 7.0.0-rc12.
Which versions are affected by CVE-2026-48063?
8 open source packages ship an affected version, including @whiskeysockets/baileys and baileys.
| Package | Affected | Fixed in |
|---|---|---|
@whiskeysockets/baileys npm | All versions | 6.7.22 |
@whiskeysockets/baileys npm | All versions | 6.7.22 |
@whiskeysockets/baileys npm | From 7.0.0-rc.1 | 7.0.0-rc12 |
@whiskeysockets/baileys npm | From 7.0.0-rc.1 | 7.0.0-rc12 |
baileys npm | All versions | 6.7.22 |
baileys npm | All versions | 6.7.22 |
2 more packages
baileys npm | From 7.0.0-rc.1 | 7.0.0-rc12 |
baileys npm | From 7.0.0-rc.1 | 7.0.0-rc12 |
How do I fix CVE-2026-48063?
Upgrade @whiskeysockets/baileys to a fixed version for your release line: 6.7.22 or 7.0.0-rc12.
Is CVE-2026-48063 being exploited?
There is no known exploitation of CVE-2026-48063 in the wild and no public exploit code.
Sources
Also known as GHSA-qvv5-jq5g-4cgg, MINI-rw3v-x2v2-f683.