{"action":"Upgrade github.com/forgekeep/nebula-mesh to 0.3.8 or later.","affected":[{"fixed":"0.3.8","introduced":"0"}],"component":"github.com/forgekeep/nebula-mesh","cve_ids":["CVE-2026-53604"],"ecosystem":"Go","epss":0.00184,"exploited":false,"fixed_versions":["0.3.8"],"ghsa_id":"GHSA-2p2f-px33-4vv5","id":"tcs_01M5KESEP6G8A2B1GVDV50DZNJ","modified_at":"2026-07-21T19:18:50.912916787Z","published_at":"2026-07-14T20:05:38Z","references":["https://osv.dev/vulnerability/GHSA-2p2f-px33-4vv5","https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-2p2f-px33-4vv5","https://github.com/forgekeep/nebula-mesh/commit/1f1ab9aa8472239763d967e3d50a3cd53a1a79b9","https://github.com/forgekeep/nebula-mesh","https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.8"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-2p2f-px33-4vv5","url":"https://osv.dev/vulnerability/GHSA-2p2f-px33-4vv5"},{"source":"nvd","source_id":"CVE-2026-53604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53604"}],"summary":"nebula-mesh: CA private key not zeroized on web mobile-bundle error paths"}