Read the docs
TI-2026-71021 Aliases CVE-2026-105668

Hex release-age cooldown is lifted when a locked release is retired

Priority LOW 33CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-693.

Summary

The hexpm hex package from 2.5.0 before 2.5.2 is affected. A protection mechanism failure (CWE-693) lets the owner of a package, or an attacker who has taken over the owner's account, get a newly published release past the release-age cooldown. When the locked release of a package is retired or has a security advisory, the cooldown is lifted for every version of that package and of its dependencies. An attacker who publishes a malicious release and retires the locked one gets it selected by the next mix deps.update, regardless of its age.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured age during dependency resolution. When the release of a package locked in mix.lock is retired or has a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1 lift the cooldown for every version of that package and of every package the locked release depends on, so that mix deps.update can move off the unsafe release. Retiring a release needs the same package owner permission as publishing one. An attacker who publishes a malicious release can retire the currently locked release, and the next mix deps.update that unlocks the package selects the new release regardless of its age. Hex.Registry.Cooldown.versions/2 checks the bypass by package name alone, so the bypass also covers packages with the same name in other repositories. Cooldown configured through an organization dependency policy is not affected. This issue affects hex: from 2.5.0 before 2.5.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00362 30th percentileScored 2026-11-07
Fix Fixed hex (hexpm): 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hexpmhex2.5.0 to before 2.5.22.5.2Patch availableCNA
  • hex Vendorhexpm Affected 2.5.0 to before 2.5.2 Fixed in 2.5.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade hex to version 2.5.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA hex (hexpm) Fixed in 2.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hexpm hex 2.5.2

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-71017 Path traversal in Hex via unvalidated dependency app namesPriority LOW 35
    • TI-2026-71020 Hex mix hex.package fetch writes unverified tarballs to stdoutPriority LOW 30
    • TI-2026-71019 Improper certificate validation in Hex when cacerts_path is setPriority LOW 26
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-105668
  2. 2026-10-13 Affected versions changed · Red Hat
  3. 2026-10-13 CVSS score added · Red Hat
  4. 2026-10-13 Priority changed: MEDIUM → LOW
  5. 2026-10-16 CISA SSVC decision points changed
  6. 2026-10-20 Affected versions changed · Red Hat
  7. 2026-10-27 Affected versions changed · Red Hat
  8. 2026-10-30 Affected versions changed · Red Hat
  9. 2026-11-04 Affected versions changed · Red Hat

References

Patch 2

Advisory 1

Other 3

  • TI-2026-24685 Lockfile checksums not verified in Hex allows dependency integrity bypass CVSS 4.0HIGH 8.9
  • TI-2026-52887 OAuth token exchange grants repository scopes for organizations the principal cannot access CVSS 4.0HIGH 8.3
  • TI-2026-17414 Password Reset Tokens Do Not Expire CVSS 4.0CRITICAL 9.5
  • TI-2026-59264 Refresh tokens accepted as private repository credentials at the CDN CVSS 4.0LOW 2.3
  • TI-2026-52890 Explicit organization scopes survive token refresh after membership ends CVSS 4.0LOW 2.3
  • TI-2026-17410 Cross-site scripting (XSS) in OAuth Device Authorization screen CVSS 4.0HIGH 8.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences