CVE-2026-82410: Pocketbase: Unhandled panic in worker goroutines
PocketBase already has builtin panic-recover middleware for the regular requests handling but it doesn't cover panics in internal child/worker goroutines which in some situations could cause termination of the server process. To prevent this from hapenning all existing internal worker functions were wrapped with the new helper `routine.SafeWrap(f)` _(auto recovers and returns any eventual panic as regular error)_. The vulnerability was reported by @gigioneggiando and it is strongly recommended to upgrade to PocketBase **[v0.39.7](https://github.com/pocketbase/pocketbase/releases/tag/v0.39.7)** _(the fix was also backported in [v0.22.48](https://github.com/pocketbase/pocketbase/releases/tag/v0.22.48) in case you are using older PocketBase < v0.23.0)_.
Recommended action
Recommended action
Upgrade affected packages to a patched version: github.com/pocketbase/pocketbase 0.22.48, github.com/pocketbase/pocketbase 0.39.7.
Technical details
- Vendor
- Not specified
- Product
- github.com/pocketbase/pocketbase
- Exploitation
- none known
- Evidence
- official
Evidence and sources
This record is attributed to GitHub Advisories. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source