Hasura

v2.45.5 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 18h API Development

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

access-control api automatic-api bigquery graphql graphql-server

+8 more

haskell hasura mongodb postgresql rest sql-server subgraph supergraph

ReleasePort's take

Moderate signal

editorial:auto 15h

This release fixes a high-severity security issue (GHSA-r27x-gc74-qmxh) and mitigates two Denial‑of‑Service vectors.

Why it matters: Addresses a high‑severity GHSA vulnerability and blocks two DoS attack paths; critical for operators of Hasura Server deployments.

Summary

AI summary

Updates Server, Data Connector, and Bug fixes and improvements across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Fixes high-severity security issue GHSA-r27x-gc74-qmxh. Fixes high-severity security issue GHSA-r27x-gc74-qmxh. Source: llm_adapter@2026-06-12 Confidence: high	—
Security	High	Mitigates two asymmetrical Denial‑of‑Service vectors. Mitigates two asymmetrical Denial‑of‑Service vectors. Source: llm_adapter@2026-06-12 Confidence: high	—
Performance	Low	Improves schema memory usage. Improves schema memory usage. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix
Bugfix	Medium	Translates control characters in malformed JSON to spaces before parsing, preserving whitespace behavior. Translates control characters in malformed JSON to spaces before parsing, preserving whitespace behavior. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Retries data connector agent capabilities fetch with bounded backoff on transient failures during startup or metadata reload. Retries data connector agent capabilities fetch with bounded backoff on transient failures during startup or metadata reload. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Ensures event triggers no longer block graceful server shutdown. Ensures event triggers no longer block graceful server shutdown. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Unlocks stuck in‑flight event triggers in the database before shutdown when multiple sources are used. Unlocks stuck in‑flight event triggers in the database before shutdown when multiple sources are used. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Fixes MariaDB update/delete mutation failures caused by temp‑table visibility race conditions (Enterprise/cloud only). Fixes MariaDB update/delete mutation failures caused by temp‑table visibility race conditions (Enterprise/cloud only). Source: llm_adapter@2026-06-12 Confidence: high	—

Full changelog

Changelog

This is a patch release for v2.45.

Bug fixes and improvements

Server

Fix a high-severity security issue: https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh . Users are strongly encouraged to upgrade.
Prior to v2.49.1 control characters in (malformed) request json could erroneously make their way into parsed json strings. v2.49.1 made such malformed json an error. This change translates all control characters to spaces before json parsing, attempting to preserve the old behavior for dodgy clients who were relying on injected literal whitespace as a whitespace delimiter in graphql payloads. Valid json bodies are unaffected by this change.
Fixed a bug where a transient connection failure to a data connector (NDC) agent during engine startup or reload_metadata could leave a source that uses that connector permanently inconsistent (Data connector named '<name>' was not found in the data connector backend info) until metadata was manually reloaded. The engine now retries the agent capabilities fetch with bounded backoff before giving up, and the resulting error message is more actionable.
Fix a bug where event triggers could prevent prompt server shutown; now we correctly only pause for actual in-flight processing
Fix a bug where, with multiple sources, in-flight event triggers which were stuck during shutdown may not have been unlocked in the database before shutdown
Mitigate two assymetrical DoS vectors.
Improvements to schema memory usage.

Data Connector

Fix MariaDB `update`/`delete` mutations still failing with `Table 'temp_table_xxx' doesn't exist` on v2.48.15. The previous fix (#11473) ran the temp-table CREATE outside the transaction, which made the CREATE and the mutation body race over pooled connections; MariaDB temp tables are session-scoped, so when the mutation body got a different pooled connection the temp table was invisible. The full CREATE / mutation / DROP lifecycle now runs pinned to one JDBC connection. (Enterprise/cloud only)

Security Fixes

GHSA-r27x-gc74-qmxh — high‑severity security issue fixed in Hasura server

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Hasura

Get notified when new releases ship.

About Hasura

Fast, instant realtime GraphQL APIs on Postgres with fine grained access control, also trigger webhooks on database events.