CVE-2026-105280

Name of the Vulnerable Software and Affected Versions hexpm hex versions 0.20.2 through 2.5.1

Description Improper validation of integrity check values allows a package mirror to substitute a tarball when using the mix hex.package fetch PACKAGE VERSION --output - command. Hex typically compares a fetched tarball's inner and outer checksums with the repository's signed registry; however, the standard output branch writes bytes returned by the Hex.SCM.fetch/3 function without this comparison. Additionally, Hex.SCM.fetch/3 does not verify freshly downloaded tarballs.

When a mirror configured via HEX MIRROR URL or mirror url serves altered bytes, the command prints them and exits successfully. Furthermore, Hex prints diagnostics to standard output, including the body of failed HTTP responses or API warnings from the x-hex-message header. A mirror can respond to these requests with an error containing a tar archive, which is then written to standard output before the verified tarball. This allows a pipeline unpacking the standard output to extract files provided by the mirror, even if the checksum check subsequently fails.

Recommendations Update hexpm hex to version 2.5.2 or later. As a temporary workaround, write the tarball to a file using --output FILE instead of standard output to ensure checksums are verified.