PostgreSQL November 2026 Security Update Explained: 52 CVEs Fixed, PostgreSQL 14 End of Life and What to Patch
Image: Wikimedia Commons — Slonik, the PostgreSQL elephant logo. The November 2026 update is the project's biggest security release in years.
TL;DR — PostgreSQL has shipped its biggest security update in years: versions 18.7, 17.12, 16.16, 15.20 and 14.25, released 12 November, close 52 security vulnerabilities — 32 of them rated 8.8 out of 10 — and fix more than 140 bugs. PostgreSQL 14 is now end-of-life, so 14.25 is the last release it will ever get. The update is a simple binary swap with no dump and reload, but extensions must be updated at the same time, and some indexes need reindexing afterwards.
📌 KEY HIGHLIGHTS
- Released 12 November 2026: PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25, plus PostgreSQL 19 Release Candidate 2.
- 52 security vulnerabilities closed — 32 of them scored 8.8 on CVSS 3.1 — and more than 140 other bugs fixed in a single release.
- Headline flaw CVE-2026-6460: type confusion after ALTER ... SET DATA TYPE can let an attacker run arbitrary code on the server. Client tools pg_dump, pg_restore and reindexdb are affected too.
- PostgreSQL 14 is now end-of-life: 14.25 is its final release, and it will receive no further security or bug fixes.
- PostgreSQL 19 RC 2 also shipped, with general availability planned for 19 November 2026.
PostgreSQL November 2026 Security Update: What Happened
The PostgreSQL Global Development Group released an update to every supported version of PostgreSQL at once on 12 November 2026. It is an unusually heavy minor release: the August 2026 update fixed 28 security issues, and this one nearly doubles that, with 52 CVEs and more than 140 bug fixes. The project says the release fixes "52 security vulnerabilities and over 140 bugs reported over the last several months" — and it warns that several of the fixes need extra steps after updating.
The update covers all five supported branches, and the same day brought the second release candidate of PostgreSQL 19. Here is the full picture:
| Branch | Fixed version | Status |
|---|---|---|
| 18 | 18.7 | Current branch — patch now |
| 17 | 17.12 | Patch now |
| 16 | 16.16 | Patch now |
| 15 | 15.20 | Patch now |
| 14 | 14.25 | Final release — end of life |
| 19 | RC 2 | Testing only — GA planned 19 Nov 2026 |
The Flaws That Matter Most
Most of the 52 flaws share a pattern: an authenticated database user can run arbitrary code on the server, or trick a client tool into running it. These are the ones to know:
| CVE | Score | What it does |
|---|---|---|
| CVE-2026-6460 | 8.8 | Type confusion after ALTER ... SET DATA TYPE executes arbitrary code |
| CVE-2026-116318 | 8.8 | pg_dump not-null constraint name allows SQL injection |
| CVE-2026-116314 | 8.8 | pg_restore executes arbitrary code (missing archive validation) |
| CVE-2026-116330 | 8.8 | pg_dump tar restore.sql fails to block psql command injection |
| CVE-2026-14661 | 8.1 | dblink and subscriptions can append to arbitrary files |
| CVE-2026-116325 | 8.0 | reindexdb index name quoting allows SQL injection |
| CVE-2026-18447 | 8.8 | Output parameter type confusion executes arbitrary code |
CVE-2026-6460 is the headline: a type confusion that an object creator can reach through ALTER ... SET DATA TYPE and similar statements, running code as the database server's operating-system user. The client-tool flaws matter just as much in practice — pg_dump, pg_restore and reindexdb are the tools teams use for backups and maintenance, so updating the server alone is not enough. The good news, as of 12 November: no exploitation and no public proof-of-concept code had been reported for these flaws. That is the window to patch in, not a reason to wait.
Illustrative image: a data centre server room (Wikimedia Commons). PostgreSQL runs the databases behind countless apps, services and internal tools.
Beyond the CVEs, the 140-plus bug fixes include several that data teams should take seriously: GIN and pg_trgm index corruption that could make queries miss rows, incremental backups that could produce corrupt backups, a rewritten planner join-removal implementation, and fixes for wrong query results and data loss after a crash. Time zone data moves to tzdata 2026f, reflecting permanent offset changes for Manitoba and Canada's Northwest Territories. The release notes list post-update steps for the index issues — reindexing affected GIN, pg_trgm and bpchar indexes, and taking a fresh full backup before relying on incremental backups again.
PostgreSQL 14 Reaches End of Life
The other headline is the end of PostgreSQL 14. The project's versioning policy supports each major version for five years, then ships a final minor release — and 14.25 is that release. The announcement is blunt: "This is the final release of PostgreSQL 14. PostgreSQL 14 is now end-of-life and will no longer receive security and bug fixes."
Anyone still running PostgreSQL 14 in production now runs an unsupported database: any vulnerability found in a version 14 code path after 12 November stays unfixed. The project suggests planning an upgrade to a newer supported version. A major-version upgrade needs pg_upgrade or a dump and reload — unlike this minor update, which is cumulative and needs only a stop, binary update and restart.
Why It Matters for Indian Developers
PostgreSQL is the default database for a huge share of Indian startups, fintech companies, SaaS products and government digital services — and many of those teams run it self-hosted on cloud VMs or on-premises servers, where nobody patches it for them. Managed services (RDS, Cloud SQL, Azure Database for PostgreSQL) will roll the fix out on their own schedules, but self-hosted deployments need someone to run the update. The practical sting is the extensions: the CVE-2026-6460 fix reaches into extensions, and the PostgreSQL package repositories rebuilt every extension against the new minors — so the server and its extensions must be updated in the same change, not one this month and the other next. For teams still on PostgreSQL 14, this release is also the deadline they have been putting off: the upgrade plan needs to move from "someday" to a dated ticket.
Should You Care?
✅ Yes — if you run PostgreSQL yourself: patch to 18.7, 17.12, 16.16 or 15.20 now, update your extensions in the same change, and reindex the indexes the release notes name. ⏳ If you use a managed service: check your provider's patch window and confirm it has landed — and check whether you are on PostgreSQL 14, because that branch is done. Do not run PostgreSQL 19 RC 2 in production: it is a release candidate for testing, with general availability planned for 19 November.
It has been a heavy week for patches generally: MongoDB fixed a critical 9.5 flaw that crashes servers at failover, and React Server Components had a 9.5 remote code execution flaw with a public proof of concept. PostgreSQL's update is the third major patch of the week — and unlike the other two, it is a routine minor release, which is exactly why it is easy to put off and exactly why it should not be.
FAQs
What versions did the PostgreSQL November 2026 security update fix?
The 12 November 2026 release shipped PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25, plus PostgreSQL 19 RC 2. Together they close 52 security vulnerabilities and fix more than 140 bugs. The update is cumulative: stop PostgreSQL, update the binaries, and restart — no dump and reload or pg_upgrade is needed for a minor release.
Is PostgreSQL 14 end of life?
Yes. Version 14.25, released 12 November 2026, is the final release of PostgreSQL 14. The branch will no longer receive security or bug fixes, so any vulnerability found in PostgreSQL 14 after that date stays unfixed. If you run PostgreSQL 14 in production, plan a major-version upgrade to 17, 18 or the coming 19.
Do I need to update PostgreSQL extensions too?
Yes — update the server and all extensions in the same change. The CVE-2026-6460 fix adds versioning for composite types, so extensions compiled against the old headers do not carry the fix until they are rebuilt. The package repositories rebuilt every extension against the new minors, and from now on extensions are rebuilt against each new minor release and require it.
When is PostgreSQL 19 released?
PostgreSQL 19 RC 2 shipped on 12 November 2026 with the same applicable fixes, and general availability is planned for 19 November 2026. A release candidate is for testing, not production — wait for the final 19.0 release, and for most teams the first minor release after it, before moving production data.
Takeaway
Fifty-two CVEs in one minor release is PostgreSQL telling you something: patch now, update the extensions with the server, reindex what the notes name — and if you are still on PostgreSQL 14, start the upgrade plan this week, because that branch will never be fixed again.
Run SELECT version(); on every database you own today. If it shows anything below 18.7, 17.12, 16.16, 15.20 or 14.25, you have your weekend job.
Sources
- PostgreSQL Global Development Group — PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released! (12 November 2026)
- The Tech Lane — PostgreSQL Just Fixed 52 Security Bugs. Is Your Database Exposed? (13 November 2026)
- Brandefense — PostgreSQL November 2026 Security Release (13 November 2026)
- Devrim Gündüz — PostgreSQL November 2026 minor releases: update the server and extensions together (12 November 2026)
Comments
Post a Comment