Hexpm Hex vulnerabilities

• erlang otp, rebar3, hexpm hex +1 more +3 more erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole CVE-2026-96596 Fix available 5.9 MediumOctober 14, 2026
• erlang rebar3, hexpm hex, hex core +2 more hex_core decompresses registry and Erlang term API responses without size limits CVE-2026-105274 Fix available 2.1 LowOctober 12, 2026
• hexpm hex Terminal escape sequence injection in Hex via unneutralized server-supplied output CVE-2026-81856 Fix available 2.3 LowOctober 12, 2026
• hexpm hex Path traversal in Hex via unvalidated dependency app names CVE-2026-96612 Fix available 7.5 HighOctober 12, 2026
• hexpm hex Hex release-age cooldown is lifted package-wide when the locked release is retired CVE-2026-105668 Fix available 7.1 HighOctober 12, 2026
• hexpm hex Hex writes unverified package tarballs to standard output in mix hex.package fetch CVE-2026-105280 Fix available 6.9 MediumOctober 12, 2026
• hexpm hex Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror CVE-2026-96618 Fix available 2.1 LowOctober 12, 2026
• hexpm hex Hex trusts its bundled CA certificates when cacerts_path is set CVE-2026-103503 Fix available 5.9 MediumOctober 12, 2026
• hexpm hex core hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 CVE-2026-103502 Fix available 5.9 MediumOctober 12, 2026
• hexpm Refresh tokens accepted as private repository credentials at the CDN CVE-2026-86698 2.3 LowSeptember 22, 2026
• hexpm Explicit organization scopes survive token refresh after membership ends CVE-2026-75554 2.3 LowAugust 24, 2026
• hexpm OAuth token exchange grants repository scopes for organizations the principal cannot access CVE-2026-75542 8.3 HighAugust 24, 2026
• hex Lockfile checksums not verified in Hex allows dependency integrity bypass CVE-2026-32148 Fix available 8.9 HighApril 30, 2026
• hex hexpm Denial of Service via Oversized Package Upload CVE-2026-23940 7.1 HighMarch 13, 2026
• hex hexpm, hexpm hex.pm +1 more Password Reset Tokens Do Not Expire CVE-2026-21622 9.5 CriticalMarch 5, 2026
• hex hexpm, hexpm hex.pm +1 more Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access CVE-2026-21621 7.0 HighMarch 5, 2026
• erlang rebar3, hex, hex core +1 more +3 more Unsafe Deserialization of Erlang Terms in hex_core CVE-2026-21619 Fix available 2.0 LowFebruary 27, 2026
• hex hexpm Path Traversal in Local File Store Backend CVE-2026-23939 6.9 MediumFebruary 26, 2026
• hex hexpm, hexpm hex.pm +1 more Cross-site scripting (XSS) in OAuth Device Authorization screen CVE-2026-21618 8.5 HighJanuary 19, 2026