# Hex Advisories.

Every Hex Advisory we hold (Elixir · Erlang), newest first.

## Records, newest first (an older page)

- [Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries](https://agentprime.io/advisories/GHSA-gvrc-75rc-7gj9.md)
  `GHSA-gvrc-75rc-7gj9`, `CVE-2026-94194`, `EEF-CVE-2026-94194` · Hex `mint`: affected `>=0.1.0, <1.10.2`, fixed in `1.10.2` · CVSS 6.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: HTTP request smuggling
- [Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size](https://agentprime.io/advisories/GHSA-q95c-ccq6-j5j6.md)
  `GHSA-q95c-ccq6-j5j6`, `CVE-2026-92103`, `EEF-CVE-2026-92103` · Hex `mint`: affected `>=0.1.0, <1.10.2`, fixed in `1.10.2` · CVSS 6.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory](https://agentprime.io/advisories/GHSA-9x8p-qrf4-jq7g.md)
  `GHSA-9x8p-qrf4-jq7g`, `CVE-2026-91043`, `EEF-CVE-2026-91043` · Hex `mint`: affected `>=1.1.0, <1.10.2`, fixed in `1.10.2` · CVSS 8.2 High · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service
- [mpp vulnerable to Gas Draining with low gas limit](https://agentprime.io/advisories/GHSA-vj8p-hp9x-gh47.md)
  `GHSA-vj8p-hp9x-gh47`, `CVE-2026-59252`, `EEF-CVE-2026-59252` · Hex `mpp`: affected `>=0.2.0, <0.6.0`, fixed in `0.6.0` · CVSS 8.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-20, CWE-1284
- [mpp vulnerable to Gas Draining with access list](https://agentprime.io/advisories/GHSA-qpxh-ff8m-c62v.md)
  `GHSA-qpxh-ff8m-c62v`, `CVE-2026-59694`, `EEF-CVE-2026-59694` · Hex `mpp`: affected `>=0.2.0, <0.6.0`, fixed in `0.6.0` · CVSS 8.3 High · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-20, CWE-1284
- [mpp vulnerable to Gas Draining with no limit](https://agentprime.io/advisories/GHSA-vv77-66rf-pm86.md)
  `GHSA-vv77-66rf-pm86`, `CVE-2026-59695`, `EEF-CVE-2026-59695` · Hex `mpp`: affected `>=0.2.0, <0.6.0`, fixed in `0.6.0` · CVSS 8.3 High · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-20, CWE-1284
- [lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS](https://agentprime.io/advisories/GHSA-8rqp-v692-v82q.md)
  `GHSA-8rqp-v692-v82q`, `CVE-2026-92106`, `EEF-CVE-2026-92106` · Hex `lazy_html`: affected `>=0.1.0, <0.1.13`, fixed in `0.1.13` · CVSS 2.3 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash](https://agentprime.io/advisories/GHSA-c2p4-p7q6-hr2j.md)
  `GHSA-c2p4-p7q6-hr2j`, `CVE-2026-93477`, `EEF-CVE-2026-93477` · Hex `ash`: affected `>=2.17.15, <3.33.11`, fixed in `3.33.11` · CVSS 5.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets](https://agentprime.io/advisories/GHSA-f4hc-ppw9-4hhw.md)
  `GHSA-f4hc-ppw9-4hhw`, `CVE-2026-55736`, `EEF-CVE-2026-55736` · Hex `ash`: affected `>=3.0.0, <3.29.3`, fixed in `3.29.3` · CVSS 5.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control
- [Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy](https://agentprime.io/advisories/GHSA-rj24-g8cc-g7g2.md)
  `GHSA-rj24-g8cc-g7g2`, `CVE-2026-91187`, `EEF-CVE-2026-91187` · Hex `nimble_zta`: affected `>=0.1.2, <0.1.3`, fixed in `0.1.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Weak cryptography or TLS
- [Plug: quadratic-time decoding of nested query/body parameters enables denial of service](https://agentprime.io/advisories/GHSA-j43x-5hjq-rgxf.md)
  `GHSA-j43x-5hjq-rgxf`, `CVE-2026-54892`, `EEF-CVE-2026-54892` · Hex `plug`: affected `>=1.15.0, <1.15.5 || >=1.16.0, <1.16.4 || >=1.17.0, <1.17.2 || >=1.18.0, <1.18.3 || >=1.19.0, <1.19.3`, fixed in `1.15.5`, `1.16.4`, `1.17.2`, `1.18.3`, `1.19.3` · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Denial of service
- [mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed](https://agentprime.io/advisories/GHSA-p9fv-9w58-95x2.md)
  `GHSA-p9fv-9w58-95x2`, `CVE-2026-87119`, `EEF-CVE-2026-87119` · Hex `mpp`: affected `>=0.14.0, <0.16.2`, fixed in `0.16.2` · CVSS 8.2 High · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free](https://agentprime.io/advisories/GHSA-8c63-r789-xrrf.md)
  `GHSA-8c63-r789-xrrf`, `CVE-2026-89420`, `EEF-CVE-2026-89420` · Hex `mpp`: affected `>=0.14.0, <0.16.2`, fixed in `0.16.2` · CVSS 7.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-1284
- [Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections](https://agentprime.io/advisories/GHSA-rj5m-69wp-cxq9.md)
  `GHSA-rj5m-69wp-cxq9`, `CVE-2026-82672`, `EEF-CVE-2026-82672` · Hex `mint`: affected `>=0.1.0, <1.10.1`, fixed in `1.10.1` · CVSS 6.3 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: HTTP request smuggling
- [Session id is not renewed on authentication in ash_authentication, allowing session fixation](https://agentprime.io/advisories/GHSA-v577-944g-7h3x.md)
  `GHSA-v577-944g-7h3x`, `CVE-2026-86688`, `EEF-CVE-2026-86688` · Hex `ash_authentication`: affected `>=0.2.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 7.4 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement](https://agentprime.io/advisories/GHSA-hh34-374j-pfr5.md)
  `GHSA-hh34-374j-pfr5`, `CVE-2026-76949`, `EEF-CVE-2026-76949` · Hex `ash_authentication`: affected `>=4.10.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover](https://agentprime.io/advisories/GHSA-73j9-m294-fvv9.md)
  `GHSA-73j9-m294-fvv9`, `CVE-2026-91039`, `EEF-CVE-2026-91039` · Hex `ash_authentication`: affected `>=5.0.0-rc.10, <5.0.0-rc.14`, fixed in `5.0.0-rc.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication](https://agentprime.io/advisories/GHSA-wc6x-276q-jrf9.md)
  `GHSA-wc6x-276q-jrf9`, `CVE-2026-88952`, `EEF-CVE-2026-88952` · Hex `ash_authentication`: affected `>=4.14.0, <4.15.0 || >=5.0.0-rc.10, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [\`require_confirmed_with\` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication](https://agentprime.io/advisories/GHSA-fc47-6pgw-wh22.md)
  `GHSA-fc47-6pgw-wh22`, `CVE-2026-85500`, `EEF-CVE-2026-85500` · Hex `ash_authentication`: affected `>=4.3.8, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-305
- [Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix](https://agentprime.io/advisories/GHSA-m6x4-4gvp-xwjr.md)
  `GHSA-m6x4-4gvp-xwjr`, `CVE-2026-86533`, `EEF-CVE-2026-86533` · Hex `ash_authentication` and 1 more: affected `>=4.9.1, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix](https://agentprime.io/advisories/GHSA-8jh5-339h-mqx9.md)
  `GHSA-8jh5-339h-mqx9`, `CVE-2026-81632`, `EEF-CVE-2026-81632` · Hex `ash_authentication` and 1 more: affected `>=3.10.5, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 7.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-598
- [Sign-in token minted for one resource accepted by another in AshAuthentication](https://agentprime.io/advisories/GHSA-3pr8-f99q-86hp.md)
  `GHSA-3pr8-f99q-86hp`, `CVE-2026-80218`, `EEF-CVE-2026-80218` · Hex `ash_authentication`: affected `>=3.10.5, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Token revocation record built from unverified JWT claims in AshAuthentication](https://agentprime.io/advisories/GHSA-mfwg-5cpf-px58.md)
  `GHSA-mfwg-5cpf-px58`, `CVE-2026-78223`, `EEF-CVE-2026-78223` · Hex `ash_authentication`: affected `>=0.2.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 6.9 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Weak cryptography or TLS
- [Log injection via an unescaped password reset identity in AshAuthentication](https://agentprime.io/advisories/GHSA-wg7g-r393-vr3g.md)
  `GHSA-wg7g-r393-vr3g`, `CVE-2026-86522`, `EEF-CVE-2026-86522` · Hex `ash_authentication`: affected `>=4.2.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 6.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Other injection
- [Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication](https://agentprime.io/advisories/GHSA-3vcj-gxx8-3p44.md)
  `GHSA-3vcj-gxx8-3p44`, `CVE-2026-81637`, `EEF-CVE-2026-81637` · Hex `ash_authentication`: affected `>=0.6.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 2.3 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Magic link single-use tokens replayable via TOCTOU race in AshAuthentication](https://agentprime.io/advisories/GHSA-23gr-vcp4-r27q.md)
  `GHSA-23gr-vcp4-r27q`, `CVE-2026-82761`, `EEF-CVE-2026-82761` · Hex `ash_authentication`: affected `>=3.9.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Race condition
- [Confirmation token accepted on any record in AshAuthentication](https://agentprime.io/advisories/GHSA-g636-26vf-2w63.md)
  `GHSA-g636-26vf-2w63`, `CVE-2026-82685`, `EEF-CVE-2026-82685` · Hex `ash_authentication`: affected `>=0.5.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Broken access control
- [Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in](https://agentprime.io/advisories/GHSA-q876-xr24-2mcx.md)
  `GHSA-q876-xr24-2mcx`, `CVE-2026-82760`, `EEF-CVE-2026-82760` · Hex `ash_authentication`: affected `>=4.8.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 8.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service
- [Reversible IP address pseudonymisation in AshAuthentication audit log hash mode](https://agentprime.io/advisories/GHSA-cgqj-pcpq-xhfm.md)
  `GHSA-cgqj-pcpq-xhfm`, `CVE-2026-82759`, `EEF-CVE-2026-82759` · Hex `ash_authentication`: affected `>=4.12.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 1.8 Low · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-760
- [Actor record with password digest stored in AshAuthentication audit log entries](https://agentprime.io/advisories/GHSA-59wx-q3r8-ghv4.md)
  `GHSA-59wx-q3r8-ghv4`, `CVE-2026-82723`, `EEF-CVE-2026-82723` · Hex `ash_authentication`: affected `>=4.12.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.2`, fixed in `4.15.0`, `5.0.0-rc.2` · CVSS 1.8 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure
- [Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle](https://agentprime.io/advisories/GHSA-7qr8-wrvq-566q.md)
  `GHSA-7qr8-wrvq-566q`, `CVE-2026-86338`, `EEF-CVE-2026-86338` · Hex `ash`: affected `>=2.11.0-rc.0, <3.33.4`, fixed in `3.33.4` · CVSS 6.0 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-1220
- [mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot](https://agentprime.io/advisories/GHSA-8x7x-5j8g-8hcx.md)
  `GHSA-8x7x-5j8g-8hcx`, `CVE-2026-88255`, `EEF-CVE-2026-88255` · Hex `mpp`: affected `>=0.2.0, <0.16.2`, fixed in `0.16.2` · CVSS 6.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-1289
- [mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches](https://agentprime.io/advisories/GHSA-82qh-vrvm-gqvc.md)
  `GHSA-82qh-vrvm-gqvc`, `CVE-2026-89186`, `EEF-CVE-2026-89186` · Hex `mpp`: affected `>=0.1.0, <0.16.2`, fixed in `0.16.2` · CVSS 6.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-524
- [SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts](https://agentprime.io/advisories/EEF-CVE-2026-77866.md)
  `EEF-CVE-2026-77866`, `CVE-2026-77866` · Hex `safeurl`: affected `>=0.1.0`, no fixed version yet · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-636
- [safeurl validated address is not bound to the request, allowing DNS rebinding](https://agentprime.io/advisories/EEF-CVE-2026-77972.md)
  `EEF-CVE-2026-77972`, `CVE-2026-77972` · Hex `safeurl`: affected `>=0.1.0`, no fixed version yet · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Race condition
- [AshLua eval read operations can read field-policy-protected fields via aggregates](https://agentprime.io/advisories/GHSA-5whv-8rcp-x33j.md)
  `GHSA-5whv-8rcp-x33j`, `CVE-2026-78216`, `EEF-CVE-2026-78216` · Hex `ash_lua`: affected `>=0.1.0, <0.2.2`, fixed in `0.2.2` · CVSS 6.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-1220
- [AshAi aggregate tool can read field-policy-protected fields](https://agentprime.io/advisories/GHSA-v5rw-36x5-r5vx.md)
  `GHSA-v5rw-36x5-r5vx`, `CVE-2026-78230`, `EEF-CVE-2026-78230` · Hex `ash_ai`: affected `>=0.1.0, <1.0.3`, fixed in `1.0.3` · CVSS 6.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-1220
- [Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata](https://agentprime.io/advisories/GHSA-j59f-776f-23hp.md)
  `GHSA-j59f-776f-23hp`, `CVE-2026-82710`, `EEF-CVE-2026-82710` · Hex `usage_rules`: affected `>=0.1.18, <1.2.8`, fixed in `1.2.8` · CVSS 2.3 Low · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-150
- [Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata](https://agentprime.io/advisories/GHSA-cj7w-j579-gc42.md)
  `GHSA-cj7w-j579-gc42`, `CVE-2026-82584`, `EEF-CVE-2026-82584` · Hex `igniter`: affected `>=0.8.1, <0.8.4`, fixed in `0.8.4` · CVSS 2.3 Low · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-150
- [AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes](https://agentprime.io/advisories/GHSA-37jv-wc37-fhcw.md)
  `GHSA-37jv-wc37-fhcw`, `CVE-2026-82586`, `EEF-CVE-2026-82586` · Hex `ash_lua`: affected `>=0.1.0, <0.2.1`, fixed in `0.2.1` · CVSS 8.2 High · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-424
- [Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry](https://agentprime.io/advisories/GHSA-qxp2-vgp9-268q.md)
  `GHSA-qxp2-vgp9-268q`, `CVE-2026-81638`, `EEF-CVE-2026-81638` · Hex `ash_double_entry`: affected `>=0.1.0, <1.0.19`, fixed in `1.0.19` · CVSS 2.1 Low · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-173
- [ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint](https://agentprime.io/advisories/GHSA-fxc6-vp68-87pw.md)
  `GHSA-fxc6-vp68-87pw`, `CVE-2026-82758`, `EEF-CVE-2026-82758` · Hex `ash_authentication_oauth2_server`: affected `>=0.1.0, <0.3.1`, fixed in `0.3.1` · CVSS 6.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF](https://agentprime.io/advisories/GHSA-wprp-8gvj-p6cv.md)
  `GHSA-wprp-8gvj-p6cv`, `CVE-2026-82757`, `EEF-CVE-2026-82757` · Hex `ash_authentication_oauth2_server`: affected `>=0.3.0, <0.3.1`, fixed in `0.3.1` · CVSS 6.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection](https://agentprime.io/advisories/GHSA-2h3v-83jg-2qmm.md)
  `GHSA-2h3v-83jg-2qmm`, `CVE-2026-82756`, `EEF-CVE-2026-82756` · Hex `ash_authentication_oauth2_server`: affected `>=0.1.3, <0.3.1`, fixed in `0.3.1` · CVSS 6.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-116
- [ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion](https://agentprime.io/advisories/GHSA-crqf-7m54-4hgc.md)
  `GHSA-crqf-7m54-4hgc`, `CVE-2026-82755`, `EEF-CVE-2026-82755` · Hex `ash_authentication_oauth2_server`: affected `>=0.1.3, <0.3.1`, fixed in `0.3.1` · CVSS 6.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-524
- [ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls](https://agentprime.io/advisories/GHSA-wwxg-h779-3wf4.md)
  `GHSA-wwxg-h779-3wf4`, `CVE-2026-82754`, `EEF-CVE-2026-82754` · Hex `ash_authentication_oauth2_server`: affected `>=0.1.0, <0.3.1`, fixed in `0.3.1` · CVSS 6.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-424
- [Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server](https://agentprime.io/advisories/GHSA-9pv3-wxjm-f846.md)
  `GHSA-9pv3-wxjm-f846`, `CVE-2026-82753`, `EEF-CVE-2026-82753` · Hex `ash_authentication_oauth2_server`: affected `>=0.3.0, <0.3.1`, fixed in `0.3.1` · CVSS 8.2 High · Not analysed yet · Published 7 Sept 2026 · Tags: Denial of service
- [Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation](https://agentprime.io/advisories/GHSA-5qrp-r24c-w6jr.md)
  `GHSA-5qrp-r24c-w6jr`, `CVE-2026-82750`, `EEF-CVE-2026-82750` · Hex `mpp`: affected `>=0.2.0, <0.16.1`, fixed in `0.16.1` · CVSS 8.3 High · Not analysed yet · Published 6 Sept 2026 · Tags: CWE-1284
- [Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning](https://agentprime.io/advisories/GHSA-rpwj-vrf7-4x36.md)
  `GHSA-rpwj-vrf7-4x36`, `CVE-2026-82751`, `EEF-CVE-2026-82751` · Hex `mpp`: affected `>=0.2.0, <0.16.1`, fixed in `0.16.1` · CVSS 8.3 High · Not analysed yet · Published 6 Sept 2026 · Tags: CWE-1284
- [Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length](https://agentprime.io/advisories/GHSA-cwjv-574p-59f6.md)
  `GHSA-cwjv-574p-59f6`, `CVE-2026-82752`, `EEF-CVE-2026-82752` · Hex `ash`: affected `>=0.10.0, <3.33.0`, fixed in `3.33.0` · CVSS 5.9 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: CWE-1284
- [Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS](https://agentprime.io/advisories/GHSA-g83f-2j6r-q6m4.md)
  `GHSA-g83f-2j6r-q6m4`, `CVE-2026-82728`, `EEF-CVE-2026-82728` · Hex `mint`: affected `>=0.1.0, <1.10.0`, fixed in `1.10.0` · CVSS 8.2 High · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service
- [Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS](https://agentprime.io/advisories/GHSA-7p8w-j234-7qc8.md)
  `GHSA-7p8w-j234-7qc8`, `CVE-2026-82729`, `EEF-CVE-2026-82729` · Hex `mint`: affected `>=1.9.3, <1.10.0`, fixed in `1.10.0` · CVSS 6.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Denial of service
- [Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor](https://agentprime.io/advisories/GHSA-4259-gvr2-4xhq.md)
  `GHSA-4259-gvr2-4xhq`, `CVE-2026-82747`, `EEF-CVE-2026-82747` · Hex `ash`: affected `>=3.4.44, <3.32.2`, fixed in `3.32.2` · CVSS 5.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records](https://agentprime.io/advisories/GHSA-j8fx-ff37-4j9c.md)
  `GHSA-j8fx-ff37-4j9c`, `CVE-2026-82749`, `EEF-CVE-2026-82749` · Hex `ash`: affected `>=3.13.2, <3.32.2`, fixed in `3.32.2` · CVSS 5.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another](https://agentprime.io/advisories/GHSA-g5hp-mghm-3mgp.md)
  `GHSA-g5hp-mghm-3mgp`, `CVE-2026-82748`, `EEF-CVE-2026-82748` · Hex `ash`: affected `>=3.5.13, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records](https://agentprime.io/advisories/GHSA-j7c9-3fw3-jc64.md)
  `GHSA-j7c9-3fw3-jc64`, `CVE-2026-82746`, `EEF-CVE-2026-82746` · Hex `ash`: affected `>=3.29.0, <3.32.2`, fixed in `3.32.2` · CVSS 5.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness](https://agentprime.io/advisories/GHSA-92x7-q3h5-wf88.md)
  `GHSA-92x7-q3h5-wf88`, `CVE-2026-82745`, `EEF-CVE-2026-82745` · Hex `ash`: affected `>=0.4.0, <3.32.2`, fixed in `3.32.2` · CVSS 5.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Ash.Reactor change step fails open, skipping a change when its where guard raises](https://agentprime.io/advisories/GHSA-3xq4-m876-fr88.md)
  `GHSA-3xq4-m876-fr88`, `CVE-2026-82744`, `EEF-CVE-2026-82744` · Hex `ash`: affected `>=3.0.0-rc.17, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-636
- [Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads](https://agentprime.io/advisories/GHSA-33wq-x3q2-c92h.md)
  `GHSA-33wq-x3q2-c92h`, `CVE-2026-82743`, `EEF-CVE-2026-82743` · Hex `ash`: affected `>=2.19.0, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service
- [Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory](https://agentprime.io/advisories/GHSA-mgwj-c69v-6f83.md)
  `GHSA-mgwj-c69v-6f83`, `CVE-2026-82742`, `EEF-CVE-2026-82742` · Hex `ash`: affected `>=1.29.0-rc0, <3.32.2`, fixed in `3.32.2` · CVSS 5.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/ecosystem/hex.md>
Older: <https://agentprime.io/advisories/ecosystem/hex.md?cursor=WyIyMDI2LTA5LTAxVDAzOjM1OjE4LjU1MTAwMFoiLCJHSFNBLW1nd2otYzY5di02ZjgzIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Hex&cursor=WyIyMDI2LTEwLTA1VDE5OjE5OjUxLjMyNjAwMFoiLCJFRUYtQ1ZFLTIwMjYtOTQyMDEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/hex/?cursor=WyIyMDI2LTEwLTA1VDE5OjE5OjUxLjMyNjAwMFoiLCJFRUYtQ1ZFLTIwMjYtOTQyMDEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.