CVE-2026-124959 · Package
NO FIX YET
The loadIndex function in nmslib hnswlib and Spotify Voyager does not check the element count in a serialized HNSW index against the stored capacity. A crafted index file can make the loader write past its heap buffer, which may crash the application that loads it.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that load HNSW index files with hnswlib or Voyager from untrusted or externally supplied sources are the exposed ones. Services that only load indexes they built themselves from trusted data are less exposed. unknown whether any specific version ranges are affected.
Not affected if trusted-index-files-only
Who cares hnswlib, node, python, vector-search, voyager
Unknown from the sources.
No fix yet, per the sources.
The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.