Affected by GO-2026-5255
and 4 other vulnerabilities
GO-2026-5255: nebula-mesh: Decrypted CA private key persists in heap after signing in github.com/forgekeep/nebula-mesh
GO-2026-5950: nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate in github.com/forgekeep/nebula-mesh
GO-2026-5984: nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh
GO-2026-5986: nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh
GO-2026-5991: nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh
ErrBadSignature is returned when the signature does not verify, either
because the canonical message was tampered, the public key does not match
the host, or the key/signature length is wrong. The poll handler maps it
to a 401 with reason=bad_signature.
Affected by 
Documentation
¶
Source Files