# CVE-2026-32148: Lockfile checksums not verified in Hex allows dependency integrity bypass

Status: published. Published: 2026-04-30. Updated: 2026-11-11.

Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.

Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected.

An attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering.

This issue affects hex: from 0.16.0 before 2.4.2.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/hexpm/hex/commit/d7528c8199a1144511508bf3a6460026a5a14c8e

## Affected products and versions

- hexpm / hex (hex): ≥ 0.16.0; < 2.4.2 (affected, semver). Source: CNA: EEF
- hexpm / hex (hexpm/hex): ≥ e01576f28c64af9fae6eb17e2dad30f6efcb303c; < d7528c8199a1144511508bf3a6460026a5a14c8e (affected, git). Source: CNA: EEF

## Severity and prioritization

- CVSS 4.0: 8.9 (high); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; source: CNA: EEF

- CISA KEV: No listing in collected sources

- EPSS: 0.19% as of 2026-11-10; percentile 8.88%

- SSVC: exploitation poc; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-354, CWE-494

## Exploit evidence

- exploit: https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v (ADP: CISA-ADP)

## References

- https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v (CNA: EEF; vendor-advisory, related)

- https://cna.erlef.org/cves/CVE-2026-32148.html (CNA: EEF; related)

- https://osv.dev/vulnerability/EEF-CVE-2026-32148 (CNA: EEF; related)

- https://github.com/hexpm/hex/commit/e01576f28c64af9fae6eb17e2dad30f6efcb303c (CNA: EEF; related)

- https://github.com/hexpm/hex/commit/d7528c8199a1144511508bf3a6460026a5a14c8e (CNA: EEF; patch)

- https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v (ADP: CISA-ADP; exploit)

## Provenance

- CNA: EEF: https://www.cve.org/CVERecord?id=CVE-2026-32148; retrieved 2026-11-11; source updated 2026-11-11

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-32148; retrieved 2026-11-11; source updated Not reported

Revision: 2ec4caf6d56cd850f217d55a6d04b44f6dc9c1246e23ad6febfbf7af09b53189

Canonical: https://y2.dev/cve/CVE-2026-32148

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.