hexpm vulnerabilities

Newest CVEs

• CVE-2026-96596

  erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

  erlang · rebar3

  Medium5.9
• CVE-2026-105274

  hex_core decompresses registry and Erlang term API responses without size limits

  erlang · rebar3

  Low2.1
• CVE-2026-81856

  Terminal escape sequence injection in Hex via unneutralized server-supplied output

  hexpm · hex

  Low2.3
• CVE-2026-96612

  Path traversal in Hex via unvalidated dependency app names

  hexpm · hex

  High7.5
• CVE-2026-105668

  Hex release-age cooldown is lifted package-wide when the locked release is retired

  hexpm · hex

  High7.1
• CVE-2026-105280

  Hex writes unverified package tarballs to standard output in mix hex.package fetch

  hexpm · hex

  Medium6.9
• CVE-2026-96618

  Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

  hexpm · hex

  Low2.1
• CVE-2026-103503

  Hex trusts its bundled CA certificates when cacerts_path is set

  hexpm · hex

  Medium5.9
• CVE-2026-103502

  hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

  hexpm · hex_core

  Medium5.9
• CVE-2026-86698

  Refresh tokens accepted as private repository credentials at the CDN

  hexpm · hexpm

  Low2.3