CVE-2026-53604

nebula-mesh (a self-hosted control plane for Slack Nebula mesh VPN by forgekeep ) is affected by a key-zeroization flaw in its web UI mobile-bundle path. The renderMobileBundle handler passes a decrypted *pki.CAManager containing the CA's ed25519 private key into mobilebundle.Build, which never c...

GO-2026-5984 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh

nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh...