Go/github.com/anycable/anycable-go CVE-2026-63405: medium 5.9, EPSS 0.21%
AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2026-6516
- nvd: CVE-2026-63405
- https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327
- https://github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c
- https://github.com/anycable/anycable/releases/tag/v1.6.15
CVE-2026-63405 · published · modified · JSON