GHSA-84vh-m24q-wjjx
Pocketbase: Unhandled panic in worker goroutines
Quick fix
GHSA-84vh-m24q-wjjx — github.com/pocketbase/pocketbase: upgrade to the fixed version with the command below.
go get github.com/pocketbase/pocketbase@v0.22.48Details
PocketBase already has builtin panic-recover middleware for the regular requests handling but it doesn't cover panics in internal child/worker goroutines which in some situations could cause termination of the server process.
To prevent this from hapenning all existing internal worker functions were wrapped with the new helper `routine.SafeWrap(f)` _(auto recovers and returns any eventual panic as regular error)_.
The vulnerability was reported by @gigioneggiando and it is strongly recommended to upgrade to PocketBase **[v0.39.7](https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7)** _(the fix was also backported in [v0.22.48](https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48) in case you are using older PocketBase < v0.23.0)_.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 0.22.48go get github.com/pocketbase/pocketbase@v0.22.480.23.0Fixed in: 0.39.7go get github.com/pocketbase/pocketbase@v0.39.7References
- https://github.com/pocketbase/pocketbase/security/advisories/GHSA-84vh-m24q-wjjx[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-82410[ADVISORY]
- https://github.com/pocketbase/pocketbase/commit/30b4184305904fae0d1b78216c4e3cc34700b220[WEB]
- https://github.com/pocketbase/pocketbase/commit/f1618ee59b6d1c0308bb474c827a2b1f24b12a95[WEB]
- https://github.com/pocketbase/pocketbase[PACKAGE]
- https://github.com/pocketbase/pocketbase/discussions/7762[WEB]
- https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48[WEB]
- https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7[WEB]