Is CVE-2026-105668 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105668 being exploited in the wild.

How severe is CVE-2026-105668?

Informational severity, published 12 October 2026.

Which products and versions are affected?

Hexpm Hex 2.5.0 to before 2.5.2.

How is CVE-2026-105668 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-105668?

Check whether you run Hexpm Hex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105668: Hex release-age cooldown bypass via package retirement

CVE-2026-105668 · Severity: info · Published 2026-10-12

Hex is a package manager for the Elixir programming language that enforces a cooldown period to prevent compromised package versions from being used before detection. A package owner or account takeover attacker can bypass this protection by retiring the currently locked version, allowing a malicious newly published release to be installed immediately on the next dependency update. This could enable supply chain attacks where malicious code reaches projects before the compromise is discovered.

Technologies: Hexpm Hex. Vendors: Hexpm.

Quick answers

Is CVE-2026-105668 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105668 being exploited in the wild.
How severe is CVE-2026-105668?: Informational severity, published 12 October 2026.
Which products and versions are affected?: Hexpm Hex 2.5.0 to before 2.5.2.
Is there a fix for CVE-2026-105668?: Yes: fixed in Hex 2.5.2. Until then: Enforce the cooldown through an organization dependency policy instead of the local cooldown setting, or run mix hex.audit before mix deps.update and review packages whose locked releases were retired before updating. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105668 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-105668?: Check whether you run Hexpm Hex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Hex 2.5.2

Enforce the cooldown through an organization dependency policy instead of the local cooldown setting, or run mix hex.audit before mix deps.update and review packages whose locked releases were retired before updating.

Technical details

The vulnerability is a protection mechanism failure (CWE-693) in Hex's cooldown bypass logic. When a locked package version is retired or has a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and unsafe_lock_bypass/1 lift the age-based cooldown for that package and its dependencies. However, Hex.Registry.Cooldown.versions/2 checks the bypass by package name alone, allowing an attacker with package owner permissions to retire the current locked release and publish a malicious replacement that bypasses the configured cooldown (e.g., HEX_COOLDOWN=7d). The attack requires package owner permissions (obtained via account takeover or legitimate ownership) and user interaction (running mix deps.update).

Affected products

hexpm Hex 2.5.0 to before 2.5.2

Timeline

2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.