Repository navigation
Security: hexpm/hex
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Hex trusts its bundled CA certificates when cacerts_path is setGHSA-rw8q-hg7m-cxgr published
Oct 12, 2026 by ericmjModerate -
Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirrorGHSA-gf42-pg2f-63jp published
Oct 12, 2026 by ericmjLow -
Hex writes unverified package tarballs to standard output in mix hex.package fetchGHSA-98jr-23pm-vj7c published
Oct 12, 2026 by ericmjModerate -
Hex release-age cooldown is lifted package-wide when the locked release is retiredGHSA-pqhp-5x9x-69h7 published
Oct 12, 2026 by ericmjHigh -
Path traversal in Hex via unvalidated dependency app namesGHSA-2vjj-c5hr-6xc3 published
Oct 12, 2026 by ericmjHigh -
Terminal escape sequence injection in Hex via unneutralized server-supplied outputGHSA-fpmj-3cxg-p766 published
Oct 12, 2026 by ericmjLow -
Lockfile checksums not verified in Hex allows dependency integrity bypassGHSA-hmv9-4mfr-m92v published
Apr 30, 2026 by ericmjHigh
