All vulnerabilities

Hex

CVE-2026-105963

Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

Severity: Unrated
Published: 23 Oct 2026
Last changed: 23 Oct 2026
Added to UpHeron: 23 Oct 2026
Fixed in: 1.7.0, 2.2.1
Also known as: EEF-CVE-2026-105963, GHSA-ffw9-w85g-f2vh
Sources: OSV.dev and GitHub

Affected software

Software	Affected versions
plugHex · `osv:Hex:plug`	From 1.6.3 before 1.7.0
plug_cryptoHex · `osv:Hex:plug_crypto`	From 1.0.0 before 2.2.1

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-105963
GitHub Advisory Database https://github.com/advisories/GHSA-ffw9-w85g-f2vh
OSV.dev https://osv.dev/vulnerability/EEF-CVE-2026-105963