{"action":"Upgrade faster-hex to 0.10.1 or later.","affected":[{"fixed":"0.10.1","introduced":"0.3.0"}],"component":"faster-hex","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.10.1"],"id":"tcs_01M5KFC9QV0XQMWZ47BPGVW5T9","modified_at":"2026-09-23T14:15:03.274936959Z","published_at":"2026-09-20T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0306","https://crates.io/crates/faster-hex","https://rustsec.org/advisories/RUSTSEC-2026-0306.html","https://github.com/nervosnetwork/faster-hex/issues/73","https://github.com/nervosnetwork/faster-hex/pull/72","https://github.com/nervosnetwork/faster-hex/pull/74"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0306","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0306"}],"summary":"`hex_decode_unchecked` AVX2 path reads past `src`"}