Live › vulnerability › CVE-2026-82410
Go to dashboardPocketBase's panic recovery does not cover its internal child and worker goroutines, so a panic there crashes the whole server process. An attacker who can trigger such a panic can take the backend offline (denial of service).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/pocketbase/pocketbase | go | >= 0.23.0, < 0.39.7 | 0.22.48, 0.39.7 |
grep pocketbase go.mod to see the pinned version; versions below 0.22.48 (0.22 line) or below 0.39.7 are affected per the description
Upgrade to 0.22.48 (0.22 line) or 0.39.7 (0.39 line), which add routine.SafeWrap around the affected worker functions.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service. The remediation introduces routine.SafeWrap to convert recovered panics into regular errors and applies it to the affected internal worker functions. This issue is fixed in versions 0.22.48 and 0.39.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-82410")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.