Release Date: October 2026
This release delivers important security and maintenance improvements across ABBYY Timeline, with a focus on strengthening platform security, addressing known vulnerabilities, and maintaining long-term stability and
supportability.
The update includes remediation of identified Common Vulnerabilities and Exposures (CVEs) through third-party library and dependency upgrades, along with improvements to build configurations and environment
maintenance.
These changes are designed to reduce security risks, maintain compatibility with supported components, and provide a more secure and reliable foundation for future releases.
The update applies to the following regions: EU, US, JP, and AU.
Security Enhancements
- Addressed identified security vulnerabilities in third-party libraries and components, including Common Vulnerabilities and Exposures (CVEs) reported through dependency scanning.
- Updated affected dependencies to reduce exposure to known security risks.
Dependency and Platform Maintenance
- Updated backend and frontend libraries to newer, more secure versions.
- Improved dependency consistency across platform components to support maintainability and future upgrades
Email Authentication Resilience
- Improved SMTP authentication handling to address a potential denial-of service vulnerability associated with inefficient authentication mechanism detection, enhancing the reliability and resilience of email-related operations
This release includes updates to third-party libraries and platform dependencies to address identified security vulnerabilities across ABBYY Timeline.
The following table identifies security advisories targeted by the remediation work included in this release.
| Component | CVE / Security Advisory | Remediation |
| ejs | CVE-2023-29827 | Replaced with Eta |
| lodash | CVE-2026-4800 | Dependency updated |
| jsonpath-plus | GHSA-pppg-cpfq-h7wr, GHSA-hw8r-x6gr-5gjp | Dependency updated |
| qs | CVE-2025-15284 | Dependency updated |
| js-yaml | CVE-2026-84375, CVE-2026-59869 | Dependency updated |
| image-size | CVE-2025-71329, CVE-2025-71330 | Dependency updated |
| sharp and associated libraries | CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591, CVE-2026-96889; GHSA-g89c-p67h-r497, GHSA-2jg2-4ch7-h545 | Dependency updated |
| tar | CVE-2024-28863, CVE-2026-73566 | Dependency updated |
| tar-fs | CVE-2025-59343, CVE-2024-12905, CVE-2025-48387 | Dependency updated |
| minimatch | CVE-2026-27904, CVE-2026-27903, CVE-2026-26996, CVE-2022-3517 | Dependency versions updated |
| brace-expansion | CVE-2026-14257, CVE-2026-13149, CVE-2026-33750, CVE-2026-69152, CVE-2025-5889 | Dependency versions updated |
| fstream | CVE-2019-13173 | Dependency removed |
| d3-color | GHSA-36jr-mh4h-2g58 | Dependency updated |
| nodemailer | GHSA-p6gq-j5cr-w38f, GHSA-9h6g-pr28-7cqp, GHSA-2x7j-588g-ccc2 | Dependency updated |
| i18next-http-backend | GHSA-q89c-q3h5-w34g | Dependency updated |
| tmp | CVE-2026-44705 | Dependency updated |
| async | CVE-2024-39249 | Dependency updated |
| source-map-js | CVE-2026-93749 | Dependency updated |
| http-cache-semantics | CVE-2026-93748 | Dependency updated |
Additional security and dependency maintenance updates were implemented across supporting platform components.
This release focuses on security and platform maintenance rather than introducing new enduser functionality. Existing workflows and product capabilities are intended to remain unchanged.