CVE-2026-105668

Name of the Vulnerable Software and Affected Versions hexpm hex versions 2.5.0 through 2.5.1

Description A protection mechanism failure allows a package owner or an attacker with account access to bypass the release-age cooldown. The cooldown, configured via cooldown or HEX COOLDOWN, normally withholds versions younger than a specific age during dependency resolution. However, when a release locked in mix.lock is retired or has a security advisory, the functions Hex.RemoteConverger.build cooldown bypass/3 and Hex.RemoteConverger.unsafe lock bypass/1 lift the cooldown for that package and its dependencies to allow mix deps.update to move to a safe release. Because Hex.Registry.Cooldown.versions/2 checks the bypass by package name alone, an attacker can publish a malicious release and retire the currently locked version, forcing the system to select the new malicious release regardless of its age. This bypass also extends to packages with the same name in other repositories. This issue does not affect cooldowns configured through organization dependency policies.

Recommendations Update hexpm hex to version 2.5.2 or later using mix local.hex. Enforce the cooldown through an organization dependency policy instead of the local cooldown setting. Run mix hex.audit before mix deps.update and avoid updating packages whose locked release was retired until the replacement has been reviewed.