CVE-2026-105668

Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured age during dependency resolution. When the release of a package locked in mix.lock is retired or has a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1 lift the cooldown for every version of that package and of every package the locked release depends on, so that mix deps.update can move off the unsafe release. Retiring a release needs the same package owner permission as publishing one. An attacker who publishes a malicious release can retire the currently locked release, and the next mix deps.update that unlocks the package selects the new release regardless of its age. Hex.Registry.Cooldown.versions/2 checks the bypass by package name alone, so the bypass also covers packages with the same name in other repositories. Cooldown configured through an organization dependency policy is not affected. This issue affects hex: from 2.5.0 before 2.5.2.

• CWE-693

• https://cna.erlef.org/cves/CVE-2026-105668.html
• https://github.com/hexpm/hex/commit/1b6fddfeadd98ed26a143f60356efade0494e2ae
• https://github.com/hexpm/hex/commit/b4e665d46be8a5f81e8cbbe4c3a67058a19cf133
• https://github.com/hexpm/hex/commit/eed2bdf85320ae9e244629511c03f5f3f8c5d0b5
• https://github.com/hexpm/hex/security/advisories/GHSA-pqhp-5x9x-69h7
• https://osv.dev/vulnerability/EEF-CVE-2026-105668

Published

Oct 12, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105659Uncontrolled Resource Consumption vulnerability in mtrudel b…8.7
• CVE-2026-10566A weakness has been identified in FoundationAgents MetaGPT u…5.3
• CVE-2026-105660Improper Validation of Syntactic Correctness of Input vulner…6.9
• CVE-2026-105661Requesting `/{username}/-/repositories` for an individual us…5.3
• CVE-2026-105664The endpoint exposes an observable response discrepancy when…5.3
• CVE-2026-105667In the default configuration, the HL7 listener accepts ADT^A…7.5
• CVE-2026-10567A security vulnerability has been detected in 1Panel-dev Cor…3.5
• CVE-2026-105672TP-Link Tapo C325WB V2 contains an unauthenticated authoriza…8.7
• CVE-2026-105673An unauthenticated denial-of-service vulnerability exists in…7.1
• CVE-2026-105674TP-Link Tapo C325WB V2 generates the pre-shared key used by …8.7
• CVE-2026-105675Ghost is a Node.js content management system. From 4.39.0 un…7.5
• CVE-2026-105676Ghost is a Node.js content management system. From 1.20.0 un…4.9