Hex vulnerabilities

Products

• Hexpm 5
• Hex 3
• Core 2

Newest

• hex Lockfile checksums not verified in Hex allows dependency integrity bypass CVE-2026-32148 Fix available 8.9 HighApril 30, 2026
• hex hexpm Denial of Service via Oversized Package Upload CVE-2026-23940 7.1 HighMarch 13, 2026
• hex hexpm, hexpm hex.pm +1 more Password Reset Tokens Do Not Expire CVE-2026-21622 9.5 CriticalMarch 5, 2026
• hex hexpm, hexpm hex.pm +1 more Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access CVE-2026-21621 7.0 HighMarch 5, 2026
• erlang rebar3, hex, hex core +1 more +3 more Unsafe Deserialization of Erlang Terms in hex_core CVE-2026-21619 Fix available 2.0 LowFebruary 27, 2026
• hex hexpm Path Traversal in Local File Store Backend CVE-2026-23939 6.9 MediumFebruary 26, 2026
• hex hexpm, hexpm hex.pm +1 more Cross-site scripting (XSS) in OAuth Device Authorization screen CVE-2026-21618 8.5 HighJanuary 19, 2026
• hex core Hex authenticity of signed packages not validated CVE-2019-1000013 Fix available 8.8 HighFebruary 4, 2019
• hex Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in... CVE-2019-1000012 8.8 HighFebruary 4, 2019