Security Exception in Flyway Package Due to Regex Injection Vulnerability
Summary
OSV-2026-1267: Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal. Affects flyway versions >= 52d835ec32875a46543a60703b8c4b9eb4be7d13, < af01b4cc086df2dd1bbc33b670924d3acd8c4373. Fixed in af01b4cc086df2dd1bbc33b670924d3acd8c4373. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flyway is an open-source database migration tool that enables developers to manage version control for their database schemas. It provides a simple and effective way to apply versioned migrations to databases, ensuring that the database schema is in sync with the application code. However, Flyway has been identified to have a vulnerability related to regex injection, which could potentially lead to security exceptions during its operation.
Vulnerability Detail
The vulnerability arises from a security exception in the method com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal. This issue was reported in OSS-Fuzz, indicating that the regex injection could be exploited to cause unexpected behavior in the application. The crash state shows that the vulnerability can be triggered during the parsing of wildcard locations in Flyway, which could lead to application crashes or unintended behavior, impacting the integrity and reliability of database migrations.
How To Fix
Minimum fixed version
af01b4cc086df2dd1bbc33b670924d3acd8c4373
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. However, it is advisable to avoid using the affected methods until the package is updated to the fixed version.
Conclusion
In summary, the Flyway package has a vulnerability related to regex injection that can lead to security exceptions. Users are advised to update to the patched version to mitigate this risk. For those unable to update immediately, it is recommended to avoid using the affected methods.
See every vulnerability recorded for flyway →
FAQ
The vulnerability is a security exception caused by regex injection, which can lead to application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
It is recommended to avoid using the affected methods until you can update to the patched version.
More details can be found in the OSS-Fuzz report linked in the vulnerability details.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time alerts.
References
Related vulnerabilities
Recent vulnerabilities recorded for flyway.
