Vulnerabilities

TI-2026-24685 CVE-2026-32148

Lockfile checksums not verified in Hex allows dependency integrity bypass

HIGH 74

Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.

CVSS 4.0HIGH 8.9 Network No auth User interaction EPSS 0.00192 Published 2026-04-30 Fixed in 2.4.2 CWE-354

TI-2026-17411 CVE-2026-21619 · GHSA-hx9w-f2w9-9g96

Unsafe Deserialization of Erlang Terms in hex_core

LOW 12

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessi…

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00638 Published 2026-02-27 Fixed in 0.12.1, 2.3.2 +1 CWE-400

TI-2019-15829 CVE-2019-1000012 · GHSA-rhxf-5pw9-q4gm

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability…

MEDIUM 40

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00877 Published 2019-02-04 No fix listed CWE-345

Vulnerabilities

Filters

Lockfile checksums not verified in Hex allows dependency integrity bypass

Unsafe Deserialization of Erlang Terms in hex_core

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability…