hex_core (Hex)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 0.20.1 or later clears every advisory below that has a fix.

Upgrade commands

mix

{:hex_core, "~> 0.20.1"} # then: mix deps.update hex_core

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
EEF-CVE-2026-96596 erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole	Not rated yet EPSS 0.21%	`>= 0.14.0, < 0.20.1`	`0.20.1`
EEF-CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits	Not rated yet EPSS 0.45%	`>= 0.1.0, < 0.20.0`	`0.20.0`
EEF-CVE-2026-103502 hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25	Not rated yet EPSS 0.24%	`>= 0.1.0, < 0.20.0`	`0.20.0`
EEF-CVE-2026-21619 Unsafe Deserialization of Erlang Terms in hex_core	High EPSS 0.64%	`>= 0.1.0, < 0.12.1`	`0.12.1`
EEF-CVE-2026-21619 Unsafe Deserialization of Erlang Terms in hex_core	High EPSS 0.64%	`< 0.12.1`	`0.12.1`
GHSA-q3cc-rr2c-87r6 Hex authenticity of signed packages not validated	High EPSS 0.88%	`< 0.4.0`	`0.4.0`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor