CVE-2026-63405: AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

September 18, 2026

The Pusher-compatible REST API includes body_md5 in the HMAC signature string but never computes or verifies the MD5 of the received HTTP body, allowing anyone who observes a signed request to replay it with an entirely different body.

References

github.com/advisories/GHSA-5p54-whvp-x327
github.com/anycable/anycable/commit/d2cbadec792f038f4695c84a65c0d957b0fde72c
github.com/anycable/anycable/releases/tag/v1.6.15
github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327
nvd.nist.gov/vuln/detail/CVE-2026-63405

Code Behaviors & Features

Detect and mitigate CVE-2026-63405 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →