GHSA-v2jf-442r-6mjh: nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction

June 26, 2026

internal/api/pop/nonce.go:25,40,86 + internal/api/server.go:38 — the signed-poll nonce cache is an in-process LRU sized at 65,536 entries. internal/api/updates.go:31 sets pollClockSkew = 5 * time.Minute as the replay window.

References

github.com/advisories/GHSA-v2jf-442r-6mjh
github.com/juev/nebula-mesh/security/advisories/GHSA-v2jf-442r-6mjh

Code Behaviors & Features

Detect and mitigate GHSA-v2jf-442r-6mjh with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →