CVE-2026-105280 Affecting erlang-hex package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ECHOLATEST-ERLANGHEX-21172986
- published17 Oct 2026
- disclosed12 Oct 2026
Introduced: 12 Oct 2026
NewCVE-2026-105280 (opens in a new tab)How to fix?
There is no fixed version for Echo:latest erlang-hex.
NVD Description
Note: Versions mentioned in the description apply only to the upstream erlang-hex package and not the erlang-hex package as distributed by Echo.
See How to fix? for Echo:latest relevant fixed versions and status.
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.
Hex compares a fetched tarball's inner and outer checksums with the repository's signed registry before writing it to a file or unpacking it. The standard output branch of mix hex.package fetch writes the bytes returned by Hex.SCM.fetch/3 without that comparison, and Hex.SCM.fetch/3 doesn't verify freshly downloaded tarballs itself. When a mirror configured with HEX_MIRROR_URL or mirror_url serves altered bytes, the command prints them and exits successfully, while the same fetch with --output FILE fails with a checksum mismatch.
Hex also prints diagnostics to standard output while the command runs: the body of a failed HTTP response from the update check or a registry fetch, and API warnings from the x-hex-message header. A mirror that answers one of those requests with an error whose body is a tar archive gets that archive written to standard output ahead of the verified tarball, so a pipeline that unpacks standard output extracts the mirror's files. This happens even when the checksum check then fails, because the archive is already on standard output.
This issue affects hex: from 0.20.2 before 2.5.2.
References
- https://advisory.echohq.com/cve/CVE-2026-105280
- https://cna.erlef.org/cves/CVE-2026-105280.html
- https://github.com/hexpm/hex/commit/69489f8b74213f03db10169e6e5407e6d5fee512
- https://github.com/hexpm/hex/commit/8a14632ca6ba8a8afd2a3f2098bc267c13e13d93
- https://github.com/hexpm/hex/commit/d1f5a085d9d4748e1f7d195e4bc39ebd77c28d9c
- https://github.com/hexpm/hex/security/advisories/GHSA-98jr-23pm-vj7c
- https://osv.dev/vulnerability/EEF-CVE-2026-105280