Hasura

v2.49.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo API Development

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

access-control api automatic-api bigquery graphql graphql-server

+8 more

haskell hasura mongodb postgresql rest sql-server subgraph supergraph

ReleasePort's take

Moderate signal

editorial:auto 1mo

The v2.49.2 release patches a high‑severity security flaw that permitted control characters in malformed JSON and resolves permanent inconsistencies caused by transient connection failures during engine startup or metadata reload.

Why it matters: Fixes a high‑severity (severity 95) issue allowing control characters in malformed JSON; prevents permanent inconsistency on transient connection failure. Address both to maintain secure, reliable service operation.

Summary

AI summary

Updates Server, CLI, and Bug fixes and improvements across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Fixes a high-severity security issue allowing control characters in malformed JSON. Fixes a high-severity security issue allowing control characters in malformed JSON. Source: llm_adapter@2026-06-11 Confidence: high	—
Feature	Medium	Adds per-migration transaction control in CLI via flag or environment variable. Adds per-migration transaction control in CLI via flag or environment variable. Source: llm_adapter@2026-06-11 Confidence: high	—
Bugfix	Medium	Fixes permanent inconsistency when transient connection failure occurs during engine startup or metadata reload. Fixes permanent inconsistency when transient connection failure occurs during engine startup or metadata reload. Source: llm_adapter@2026-06-11 Confidence: high	—

Full changelog

Changelog

This is a patch release for v2.49.

Bug fixes and improvements

Server

Fix a high-severity security issue: https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh . Users are strongly encouraged to upgrade.
Prior to v2.49.1 control characters in (malformed) request json could erroneously make their way into parsed json strings. v2.49.1 made such malformed json an error. This change translates all control characters to spaces before json parsing, attempting to preserve the old behavior for dodgy clients who were relying on injected literal whitespace as a whitespace delimiter in graphql payloads. Valid json bodies are unaffected by this change.
Fixed a bug where a transient connection failure to a data connector (NDC) agent during engine startup or reload_metadata could leave a source that uses that connector permanently inconsistent (Data connector named '<name>' was not found in the data connector backend info) until metadata was manually reloaded. The engine now retries the agent capabilities fetch with bounded backoff before giving up, and the resulting error message is more actionable.

CLI

(cli) Add per-migration transaction control. Running hasura migrate apply --per-migration-transaction (or setting HASURA_GRAPHQL_PER_MIGRATION_TRANSACTION=true) enables a mode where individual SQL migrations can opt out of transactions by placing -- hasura:no-transaction as the first line of the file. This allows statements like CREATE INDEX CONCURRENTLY to coexist with fully transactional migrations in the same project, without requiring the global --no-transaction flag. The marker is ignored and behavior is unchanged when the flag is not set.

Security Fixes

GHSA-r27x-gc74-qmxh — fixes a high-severity security issue in the server component

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Hasura

Get notified when new releases ship.

About Hasura

Fast, instant realtime GraphQL APIs on Postgres with fine grained access control, also trigger webhooks on database events.