AIKIDO-2026-276642
github.com/dunglas/mercure/caddy is vulnerable to Exposure of Resource to Wrong Sphere
78
High Risk
This Affects:
github.com/dunglas/mercure/caddyTL;DR
Caddy's pooled transports for the Mercure module and its deprecated transport key are shared across every hub configured in the same process, keyed only by target or path and not by hub name. Two differently named hubs in one Caddy instance reuse the same pooled transport, local subscriber list, or BoltDB handle, so one hub's subscribers can receive another hub's private updates. The fix includes the configured hub name in the key for every pooled transport so differently named hubs never share subscribers or history.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run more than one hub in the same Caddy process.
Background info
github.com/dunglas/mercure/caddy is vulnerable to Exposure of Resource to Wrong Sphere in versions 0.11.3 - 1.0.0.
How to fix this
Upgrade the github.com/dunglas/mercure/caddy library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.