Hasura

v2.49.3 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo API Development

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

access-control api automatic-api bigquery graphql graphql-server

+8 more

haskell hasura mongodb postgresql rest sql-server subgraph supergraph

Affected surfaces

deps breaking_upgrade

Summary

AI summary

Updates Server, Data Connector, and Build across a mixed release.

Full changelog

Changelog

This is a patch release for v2.49.

Bug fixes and improvements

Server

Added HASURA_GRAPHQL_DISABLE_EVENT_PROCESSING env var (and --disable-event-processing CLI flag) to stop the eventing background pollers — event triggers, scheduled events, the cron event generator, and async actions — without disabling the rest of the eventing subsystem. Unlike HASURA_GRAPHQL_DISABLE_EVENTING, source catalog migrations still run, so the eventing catalog tables are created on a fresh database. The cli-migrations v2 and v3 entrypoints now use this flag, fixing metadata apply failing on a fresh database when the metadata defines event triggers.

Data Connector

super-connector: upgraded redshift-jdbc42 (2.2.2), Netty (4.1.135.Final, including the copy shaded into the Athena JDBC driver), and the Quarkus platform (3.33.1.1, for quarkus-vertx-http) to remediate CRITICAL/HIGH CVEs flagged by the container image scan. (Enterprise/cloud only)

Build

Updated the Ubuntu base image of the graphql-engine Docker images to pull patched OS packages, fixing CVE-2026-45447 (openssl heap use-after-free in PKCS7_verify()) by upgrading openssl/libssl3 from 3.0.2-0ubuntu1.21 to 3.0.2-0ubuntu1.25.

Security Fixes

CVE-2026-45447 — OpenSSL heap use-after-free in PKCS7_verify() fixed by upgrading openssl/libssl3 from 3.0.2-0ubuntu1.21 to 3.0.2-0ubuntu1.25
dep: Critical/HIGH CVEs remediated by upgrading redshift-jdbc42 (2.2.2), Netty (4.1.135.Final), and Quarkus platform (3.33.1.1) in the super‑connector

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Hasura

Get notified when new releases ship.

About Hasura

Fast, instant realtime GraphQL APIs on Postgres with fine grained access control, also trigger webhooks on database events.