hexpm hex vulnerabilities

Latest hexpm hex CVEs

Newest publication first

1. CVE-2026-96596 erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

   Published 2026-10-14

   Medium·CVSS 5.9 EPSS 0.21%

   Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a d...

2. CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits

   Published 2026-10-12

   Low·CVSS 2.1 EPSS 0.45%

   Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_he...

3. CVE-2026-81856 Terminal escape sequence injection in Hex via unneutralized server-supplied output

   Published 2026-10-12

   Low·CVSS 2.3 EPSS 0.43%

   Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository an...

4. CVE-2026-96612 Path traversal in Hex via unvalidated dependency app names

   Published 2026-10-12

   High·CVSS 7.5 EPSS 0.44%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A pac...

5. CVE-2026-105668 Hex release-age cooldown is lifted package-wide when the locked release is retired

   Published 2026-10-12

   High·CVSS 7.1 EPSS 0.36%

   Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger th...

6. CVE-2026-105280 Hex writes unverified package tarballs to standard output in mix hex.package fetch

   Published 2026-10-12

   Medium·CVSS 6.9 EPSS 0.21%

   Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksums with the repositor...

7. CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

   Published 2026-10-12

   Low·CVSS 2.1 EPSS 0.36%

   Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirro...

8. CVE-2026-103503 Hex trusts its bundled CA certificates when cacerts_path is set

   Published 2026-10-12

   Medium·CVSS 5.9 EPSS 0.21%

   Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves tha...

9. CVE-2026-32148 Lockfile checksums not verified in Hex allows dependency integrity bypass

   Published 2026-04-30

   High·CVSS 8.9 EPSS 0.19%

   Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums. Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked bui...

10. CVE-2026-21619 Unsafe Deserialization of Erlang Terms in hex_core

    Published 2026-02-27

    Low·CVSS 2.0 EPSS 0.64%

    Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.