CVE-2026-82410

HighCVSS 8.7

Published: 16/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 16/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.58%

45th percentile - higher than 45% of all known CVEs

Summary

PocketBase is an open source web backend written in Go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service.

Risk Assessment

An attacker can trigger a panic in an internal goroutine, causing the PocketBase server process to terminate and making the service unavailable to all users.

Recommendation

Update PocketBase to version 0.22.48 or 0.39.7, which introduce routine.SafeWrap to convert recovered panics into regular errors.

Other vulnerabilities in PocketBase

CVE-2026-44166High
Pocketbase, an open source web backend, has a vulnerability that allows an attacker to create and link an unverified user if they know the victim's email address. When the victim is invited to the app, the user created by the attacker will be automatically linked and verified.

Original NVD description (English source)

Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process, causing a denial of service. The remediation introduces routine.SafeWrap to convert recovered panics into regular errors and applies it to the affected internal worker functions. This issue is fixed in versions 0.22.48 and 0.39.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS