PatchTheCVEhermes vulnerabilities and fixes
Recent CVEs affecting hermes, with upgrade or downgrade steps. 2 tracked.
hermes has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-01-12. Highest priority: CVE-2025-1293 (score 41/100).
- CVE-2026-22798 MEDIUM 5.9 UPGRADE hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata
- CVE-2025-1293 HIGH 8.2 UPGRADE Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode,
FAQ
How do I fix hermes vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is hermes being exploited right now?
None of the tracked hermes CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which hermes CVE should I patch first?
CVE-2025-1293 currently ranks highest (41/100): Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, .