GHSA-84vh-m24q-wjjx
Pocketbase: Unhandled panic in worker goroutines
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/pocketbase/pocketbase | < 0.22.48 | 0.22.48 |
| Go | github.com/pocketbase/pocketbase | >= 0.23.0, < 0.39.7 | 0.39.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
PocketBase already has builtin panic-recover middleware for the regular requests handling but it doesn't cover panics in internal child/worker goroutines which in some situations could cause termination of the server process.
To prevent this from hapenning all existing internal worker functions were wrapped with the new helper `routine.SafeWrap(f)` _(auto recovers and returns any eventual panic as regular error)_.
The vulnerability was reported by @gigioneggiando and it is strongly recommended to upgrade to PocketBase **[v0.39.7](https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7)** _(the fix was also backported in [v0.22.48](https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48) in case you are using older PocketBase < v0.23.0)_.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/pocketbase/pocketbase/security/advisories/GHSA-84vh-m24q-wjjx
- https://nvd.nist.gov/vuln/detail/CVE-2026-82410
- https://github.com/pocketbase/pocketbase/commit/30b4184305904fae0d1b78216c4e3cc34700b220
- https://github.com/pocketbase/pocketbase/commit/f1618ee59b6d1c0308bb474c827a2b1f24b12a95
- https://github.com/pocketbase/pocketbase
- https://github.com/pocketbase/pocketbase/discussions/7762
- https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48
- https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7