PatchTheCVEnav2 vulnerabilities and fixes
Recent CVEs affecting nav2, with upgrade or downgrade steps. 5 tracked.
nav2 has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-02-12. Highest priority: CVE-2026-26011 (score 59/100).
- CVE-2026-26011 CRITICAL 9.8 UPGRADE navigation2 is a ROS 2 Navigation Framework and System
- CVE-2024-25199 HIGH 8.1 UPGRADE MITIGATE Inappropriate pointer order of map_sub_ and map_free(map_) (amcl_node.cpp) in Open Robotics Robotic Operating
- CVE-2024-25198 CRITICAL 9.1 UPGRADE MITIGATE Inappropriate pointer order of laser_scan_filter_.reset() and tf_listener_.reset() (amcl_node.cpp) in Open Rob
- CVE-2024-25197 MEDIUM 6.5 UPGRADE MITIGATE Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions were discovered to contain a NULL po
- CVE-2024-25196 LOW 3.3 UPGRADE MITIGATE Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer
FAQ
How do I fix nav2 vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nav2 being exploited right now?
None of the tracked nav2 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nav2 CVE should I patch first?
CVE-2026-26011 currently ranks highest (59/100): navigation2 is a ROS 2 Navigation Framework and System.