{"id":"CVE-2026-82410","aliases":["GHSA-84vh-m24q-wjjx","GO-2026-6489"],"url":"https://o3.security/vulnerability/CVE-2026-82410","summary":"Pocketbase: Unhandled panic in worker goroutines","details":"PocketBase already has builtin panic-recover middleware for the regular requests handling but it doesn't cover panics in internal child/worker goroutines which in some situations could cause termination of the server process.\n\nTo prevent this from hapenning all existing internal worker functions were wrapped with the new helper `routine.SafeWrap(f)` _(auto recovers and returns any eventual panic as regular error)_.\n\nThe vulnerability was reported by @gigioneggiando and it is strongly recommended to upgrade to PocketBase **[v0.39.7](https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7)** _(the fix was also backported in [v0.22.48](https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48) in case you are using older PocketBase < v0.23.0)_.","published":"2026-09-16T14:59:19.985Z","modified":"2026-10-28T02:30:53.561041322Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/pocketbase/pocketbase","fixedVersion":"0.22.48"},{"ecosystem":"Go","name":"github.com/pocketbase/pocketbase","fixedVersion":"0.39.7"}],"fix":{"url":"https://github.com/pocketbase/pocketbase/commit/30b4184305904fae0d1b78216c4e3cc34700b220","label":"pocketbase/pocketbase@30b4184"},"references":[{"type":"WEB","url":"https://github.com/pocketbase/pocketbase/discussions/7762"},{"type":"WEB","url":"https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48"},{"type":"WEB","url":"https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82410.json"},{"type":"ADVISORY","url":"https://github.com/pocketbase/pocketbase/security/advisories/GHSA-84vh-m24q-wjjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82410"},{"type":"FIX","url":"https://github.com/pocketbase/pocketbase/commit/30b4184305904fae0d1b78216c4e3cc34700b220"},{"type":"FIX","url":"https://github.com/pocketbase/pocketbase/commit/f1618ee59b6d1c0308bb474c827a2b1f24b12a95"},{"type":"PACKAGE","url":"https://github.com/pocketbase/pocketbase"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:53.561041322Z"}}