CVE-2026-82410

Name of the Vulnerable Software and Affected Versions Pocketbase versions prior to 0.22.48 Pocketbase versions prior to 0.39.7

Description The panic-recovery middleware handles regular requests but does not cover internal child and worker goroutines. A panic within these internal goroutines can bypass recovery mechanisms and terminate the server process, resulting in a denial of service. To address this, the routine.SafeWrap() function was introduced to convert recovered panics into regular errors and apply them to the affected internal worker functions.

Recommendations Update to version 0.22.48. Update to version 0.39.7.