Hasura announced the v2.45.5 patch for its GraphQL Engine on 12 June 2026. The release focuses on security, stability, and performance improvements.
Critical security fix
The update resolves a high‑severity security issue. Hasura explicitly urges all users to upgrade to mitigate the vulnerability.
JSON control‑character handling
Prior to v2.49.1, malformed request JSON containing control characters could leak those characters into parsed strings. The new behaviour translates any control characters to spaces before parsing, preserving legacy behaviour for clients that relied on injected whitespace while leaving valid JSON untouched.
Data connector resilience
A transient connection failure to a Data Connector (NDC) agent during engine startup or reload_metadata previously left the source in an inconsistent state. The patch adds a bounded‑backoff retry for fetching agent capabilities and provides a clearer error message.
Event‑trigger and shutdown fixes
- Event triggers no longer block server shutdown; the engine now pauses only for truly in‑flight processing.
- When multiple sources are present, stuck in‑flight event triggers are now correctly unlocked in the database before shutdown.
DoS mitigation and memory usage
Two asymmetric denial‑of‑service vectors have been mitigated, and schema memory usage has been optimised.
Enterprise‑only MariaDB mutation fix
The patch corrects a regression where MariaDB UPDATE/DELETE mutations could fail with “Table ‘temp_table_xxx' doesn't exist”. The full temporary‑table lifecycle now runs on a single JDBC connection, preventing race conditions across pooled connections.
Upgrade recommendation
Given the security fix and the breadth of stability improvements, Hasura recommends that all deployments upgrade to v2.45.5 as soon as possible.