Hex maintains a narrowly scoped package-management and build-tooling ecosystem for the Erlang programming language, with vulnerabilities concentrating in its core package repository, package manager, and language libraries. Its disclosures skew toward serious outcomes, with an elevated share reaching critical severity; the recurring weakness classes—including insufficient data authenticity verification, uncontrolled resource consumption, deserialization of untrusted data, unsafe code downloads, and path traversal—reflect the supply-chain and artifact-handling role these tools occupy. Defenders should treat package-manager updates as high-priority, particularly around dependency integrity and build-artifact validation; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Hex over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-21622CRITICAL Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover.
Password reset tokens generated via the | Mar 5, 2026 | 9.8 | 30 | NO | NO |
CVE-2026-32148MEDIUM Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.
Hex st | Apr 30, 2026 | 5.9 | 26 | NO | NO |
CVE-2026-21619HIGH Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api m | Feb 27, 2026 | 7.5 | 25 | NO | NO |
CVE-2026-23939HIGH Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal | Feb 26, 2026 | 7.5 | 25 | NO | NO |
CVE-2019-1000013HIGH Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detecte | Feb 4, 2019 | 8.8 | 25 | NO | NO |
CVE-2019-1000012HIGH Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, al | Feb 4, 2019 | 8.8 | 25 | NO | NO |
CVE-2026-23940MEDIUM Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extrac | Mar 13, 2026 | 6.5 | 22 | NO | NO |
CVE-2026-21618MEDIUM Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) a | Jan 19, 2026 | 6.1 | 21 | NO | NO |
CVE-2026-21621MEDIUM Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation.
An API key created with read-only permission | Mar 5, 2026 | 5.3 | 19 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Hex.
Media articles that mention a CVE ID that affects a product developed by Hex — matched by CVE ID, not by vendor name.