Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

hex.pm

4 known vulnerabilities (2 high, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 high, 2 low
Registry
Hex

Advisories 4

  • Refresh tokens accepted as private repository credentials at the CDN

    Affected: from 2025-10-10, fixed in 2026-09-22.

  • Explicit organization scopes survive token refresh after membership ends

    Affected: from 2025-10-10, fixed in 2026-08-24.

  • OAuth token exchange grants repository scopes for organizations the principal cannot access

    Affected: from 2025-10-18, fixed in 2026-08-24.

  • Denial of Service via Oversized Package Upload

    Affected: fixed in 2026-03-10.