{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/anycable/anycable-go","cve_ids":["CVE-2026-63405"],"ecosystem":"Go","epss":0.00209,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-5p54-whvp-x327","id":"tcs_01M5KGV56QK50A5YCDT6QZV260","modified_at":"2026-09-28T17:00:16.361269720Z","published_at":"2026-09-28T16:43:40Z","references":["https://osv.dev/vulnerability/GO-2026-6516","https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327","https://github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c","https://github.com/anycable/anycable/releases/tag/v1.6.15"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GO-2026-6516","url":"https://osv.dev/vulnerability/GO-2026-6516"},{"source":"nvd","source_id":"CVE-2026-63405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63405"}],"summary":"AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body in github.com/anycable/anycable-go"}