CVE-2026-105668
Received Received - Intake

Protection Mechanism Failure in Hex Package Manager

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: EEF

Description
Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured age during dependency resolution. When the release of a package locked in mix.lock is retired or has a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1 lift the cooldown for every version of that package and of every package the locked release depends on, so that mix deps.update can move off the unsafe release. Retiring a release needs the same package owner permission as publishing one. An attacker who publishes a malicious release can retire the currently locked release, and the next mix deps.update that unlocks the package selects the new release regardless of its age. Hex.Registry.Cooldown.versions/2 checks the bypass by package name alone, so the bypass also covers packages with the same name in other repositories. Cooldown configured through an organization dependency policy is not affected. This issue affects hex: from 2.5.0 before 2.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-105668
EUVD
EUVD-2026-97503

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hexpm hex 2.5.0
hexpm hex b4e665d46be8a5f81e8cbbe4c3a67058a19cf133

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Protection Mechanism Failure in the Hex package manager where an attacker who controls a package owner's account can bypass the release-age cooldown. The cooldown normally prevents newly published releases from being used in dependency resolution until they reach a certain age. However, retiring a locked release or marking it with a security advisory triggers a bypass that lifts the cooldown for all versions of that package and its dependencies, allowing malicious updates to be selected regardless of age.

Detection Guidance

Check Hex version with mix hex.info. If using versions 2.5.0 to 2.5.1, the system is vulnerable. Review mix.lock for retired or security advisory-marked packages. Run mix deps.update to see if cooldown bypass occurs.

Impact Analysis

If you use Hex versions 2.5.0 to 2.5.1 with local cooldown settings, an attacker could publish a malicious package version, retire the currently locked safe version, and trick your system into selecting the malicious update via mix deps.update. This could lead to execution of malicious code during dependency compilation, potentially compromising your system's confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized code execution in systems handling sensitive data, potentially violating GDPR's integrity and confidentiality requirements or HIPAA's security controls for protected health information. Organizations using affected Hex versions may face compliance violations if malicious dependencies are introduced through this bypass mechanism.

Mitigation Strategies

Upgrade Hex to version 2.5.2 or later. Enforce cooldowns via organization policies instead of local settings. Audit dependencies before updates and avoid using retired packages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105668. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart