# Security Release Notes
source: https://docs.chalk.ai/docs/security-release-notes

## CVE fixes shipped in Chalk components.

This page lists only fixes for published CVEs. Each entry names the CVE, the Chalk components it affected, and the dependency versions that contain the fix. For product updates, see the changelog.

### October 23, 2026

### CVE-2026-111497: Brotli decoder out-of-bounds write

The Brotli C decoder could write past its buffer while decoding crafted Brotli data. This can crash the decoding process and may allow code execution. Node.js bundles the affected decoder.

| Component              | Fix                                                                          |
| ---------------------- | ---------------------------------------------------------------------------- |
| Chalk dashboard images | Node.js 22.23.4. Image builds reject Node.js 22 releases older than 22.23.4. |

### August 20, 2026

### CVE-2026-8838: Code execution in redshift-connector

redshift-connector passed server-sent data to eval() in vector_in(), so a malicious Redshift server or a man-in-the-middle could run arbitrary code on the client. The CVE is rated critical.

| Component                                      | Fix                                  |
| ---------------------------------------------- | ------------------------------------ |
| Query engine, API server, and shared libraries | `redshift-connector` 2.1.11 → 2.1.14 |

### CVE-2026-41889: SQL injection in pgx

pgx could mistake a dollar-quoted string for a query placeholder, which allowed SQL injection.

| Component        | Fix                                      |
| ---------------- | ---------------------------------------- |
| Chalk API server | `github.com/jackc/pgx/v5` 5.9.1 → 5.10.0 |

### CVE-2026-39882: Unbounded response reads in OpenTelemetry OTLP HTTP exporters

The OpenTelemetry Go OTLP HTTP trace and metric exporters read response bodies without a size limit.

| Component        | Fix                                                                 |
| ---------------- | ------------------------------------------------------------------- |
| Chalk API server | OpenTelemetry Go `otlptrace` and `otlpmetric` HTTP exporters 1.44.0 |

### CVE-2026-45045: GoFiber

| Component        | Fix                                             |
| ---------------- | ----------------------------------------------- |
| Chalk API server | `github.com/gofiber/fiber/v2` 2.52.12 → 2.52.15 |

### CVE-2026-39821: Datadog serverless-init

| Component                                           | Fix                      |
| --------------------------------------------------- | ------------------------ |
| Chalk images that include Datadog `serverless-init` | `serverless-init` 1.10.3 |