Insufficient Data Verification Vulnerability in Hex Package Manager

CVE-2026-32148

What is CVE-2026-32148?

The Hex package manager contains a vulnerability in the Hex.RemoteConverger module, which relates to insufficient verification of checksum integrity for dependencies. When dependency resolutions occur, the Hex.RemoteConverger.verify_resolved/2 function fails to implement checksum verification due to a data type mismatch between string-based dependency names in the lockfile and atom-based names utilized in the verification logic. This oversight permits attackers to bypass integrity checks, enabling them to replace dependencies with modified contents through local cache poisoning or compromised package registries without detection. Consequently, when packages are fetched from the registry, their checksums are validated; however, later mismatches between the lockfile and the resolved dependencies remain undetected, potentially leading to tampered package builds.

References