fix(deps): force patched cowboy 2.18 (CVE-2026-43966) - #234
Merged
Conversation
cowboy < 2.16.0 has an HTTP request/response splitting vuln (GHSA-w4f7-4cxr-rv3c, CVE-2026-43966, published 2026-07-29). nova pulls cowboy 2.15.0 transitively; promote it to a direct dep pinned ~> 2.16 (resolves to 2.18.0) to override that until nova ships a patched cowboy. App boots + full matchmaker suite green on 2.18. Root fix tracked upstream (novaframework/nova cowboy bump).
Taure
added a commit
that referenced
this pull request
Aug 7, 2026
cowboy became a direct dependency in #234 to force a patched 2.18 past nova's exact 2.15.0 pin, which was vulnerable to CVE-2026-43966. nova 0.15.3 pins 2.18.0 itself, so the override has done its job and asobi should not be second-guessing which cowboy its web framework runs on. cowboy still resolves to 2.18.0, now transitively at depth 1 rather than declared at depth 0, so nothing about the running code changes and the CVE stays fixed. rebar3 audit reports no vulnerabilities across all 21 dependencies. asobi does call cowboy_req directly, 186 times, so this is not a case of dropping something unused. It is that nova pins cowboy exactly, which leaves a direct constraint here redundant when it agrees and a build failure when it does not. Verified on a clean _build: eunit 1661 tests, ct 341 tests against Postgres 17, plus audit, xref, dialyzer and fmt.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security: cowboy < 2.16.0 has an HTTP request/response-splitting vuln (GHSA-w4f7-4cxr-rv3c / CVE-2026-43966, published today). nova pulls cowboy 2.15.0 transitively, so the repo's Audit now fails closed (main included; it just hasn't re-run since the CVE was published).
Promotes cowboy to a direct dep pinned
~> 2.16(resolves to 2.18.0), overriding nova's transitive 2.15.0. App boots and the full matchmaker CT suite passes on 2.18. Root fix is an upstream nova cowboy bump (PR incoming); revert this override once nova releases it.Unblocks the Audit gate on all open asobi PRs.