Hasura

v2.49.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo API Development

✓ No known CVEs patched

This release patches 1 known CVE

Topics

access-control api automatic-api bigquery graphql graphql-server

+8 more

haskell hasura mongodb postgresql rest sql-server subgraph supergraph

Summary

AI summary

Mitigated two asymmetrical denial‑of‑service vectors and fixed bugs that prevented prompt server shutdown.

Type	Severity	Summary	CVE
Security	High	Mitigates two asymmetrical denial‑of‑service vectors Mitigates two asymmetrical denial‑of‑service vectors Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Fixes bug preventing prompt server shutdown when event triggers are pending Fixes bug preventing prompt server shutdown when event triggers are pending Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	Medium	Fixes database lock issue leaving stuck event triggers during shutdown with multiple sources Fixes database lock issue leaving stuck event triggers during shutdown with multiple sources Source: llm_adapter@2026-06-04 Confidence: high	—

Full changelog

This is a patch release for v2.49.

Fix a bug where event triggers could prevent prompt server shutown; now we correctly only pause for actual in-flight processing
Fix a bug where, with multiple sources, in-flight event triggers which were stuck during shutdown may not have been unlocked in the database before shutdown
Mitigate two assymetrical DoS vectors.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Hasura

Get notified when new releases ship.

About Hasura

Fast, instant realtime GraphQL APIs on Postgres with fine grained access control, also trigger webhooks on database events.