Announcing Snyk CLI v1.1308.3

We are pleased to announce Snyk CLI release, v1.1308.3

Following the compromise of eMudhra intermediate certificate authorities, we strongly advise all customers to upgrade to Snyk CLI v1.1308.3 or later.

This release includes a security update that blocks trust in the affected certificates. Earlier versions may accept forged certificates, potentially allowing an attacker able to intercept network traffic to impersonate a trusted service and read or modify CLI communications.

Please update CLI installations across developer machines, CI/CD pipelines, container images, and elsewhere.

Customers running the legacy CLI exclusively through Node.js should upgrade the Node.js runtime used to execute the CLI to a version that addresses this issue.

This update includes the following:

• Fixed vulnerabilities:

  • Updates the embedded Node.js runtime to 22.23.4 to address CVE-2026-105481, CVE-2026-105482, CVE-2026-106069, CVE-2026-106073, CVE-2026-106074, and CVE-2026-111497

  • Updates the toml library used by snyk fix for Poetry projects to 5.0.1 to address CVE-2026-114141, CVE-2026-114142, CVE-2026-114143, and CVE-2026-114144

To learn more please reference the full release notes. If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.