Security Release Notes

This page lists only fixes for published CVEs. Each entry names the CVE, the Chalk components it affected, and the dependency versions that contain the fix. For product updates, see the changelog.

​

October 23, 2026

​

CVE-2026-111497: Brotli decoder out-of-bounds write

The Brotli C decoder could write past its buffer while decoding crafted Brotli data. This can crash the decoding process and may allow code execution. Node.js bundles the affected decoder.

Component	Fix
Chalk dashboard images	Node.js 22.23.4. Image builds reject Node.js 22 releases older than 22.23.4.

​

August 20, 2026

​

CVE-2026-8838: Code execution in redshift-connector

redshift-connector passed server-sent data to eval() in vector_in(), so a malicious Redshift server or a man-in-the-middle could run arbitrary code on the client. The CVE is rated critical.

Component	Fix
Query engine, API server, and shared libraries	redshift-connector 2.1.11 → 2.1.14

​

CVE-2026-41889: SQL injection in pgx

pgx could mistake a dollar-quoted string for a query placeholder, which allowed SQL injection.

Component	Fix
Chalk API server	github.com/jackc/pgx/v5 5.9.1 → 5.10.0

​

CVE-2026-39882: Unbounded response reads in OpenTelemetry OTLP HTTP exporters

The OpenTelemetry Go OTLP HTTP trace and metric exporters read response bodies without a size limit.

Component	Fix
Chalk API server	OpenTelemetry Go otlptrace and otlpmetric HTTP exporters 1.44.0

​

CVE-2026-45045: GoFiber

Component	Fix
Chalk API server	github.com/gofiber/fiber/v2 2.52.12 → 2.52.15

​

CVE-2026-39821: Datadog serverless-init

Component	Fix
Chalk images that include Datadog serverless-init	serverless-init 1.10.3