Detections
Analytics

SCA: security update for github.com/dunglas/mercure (GHSA-hwr4-mq23-wcv5)

high Tenable Cloud Security Plugin ID 440091

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Mercure is a protocol for pushing data updates to web browsers and other HTTP clients in a battery-
 efficient way. Prior to 0.22.0, a cache key collision vulnerability in TopicSelectorStore allows an
 attacker to poison the match result cache, potentially causing private updates to be delivered to
 unauthorized subscribers or blocking delivery to authorized ones. The cache key was constructed by
 concatenating the topic selector and topic with an underscore separator. Because both topic selectors and
 topics can contain underscores, two distinct pairs can produce the same key. An attacker who can subscribe
 to the hub or publish updates with crafted topic names can exploit this to bypass authorization checks on
 private updates. This vulnerability is fixed in 0.22.0. (CVE-2026-39972)

Solution

Update the github.com/dunglas/mercure library and its related packages to version 0.22.0 or later.

See Also

https://github.com/advisories/GHSA-hwr4-mq23-wcv5

Plugin Details

Severity: High

ID: 440091

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 4/9/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.29

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-39972

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 5

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/8/2026

Vulnerability Publication Date: 4/8/2026

Reference Information

CVE: CVE-2026-39972