Threats affecting pkg:hex/tidewave

CVE-2026-109823 is a vulnerability in tidewave versions from 0.8.0 up to but not including 0.9.2 that allows an attacker to read filesystem path names exposed via Tidewave configuration endpoints and the rendered toolbar. The issue arises because responses do not validate the Host header, enabling a web page that rebinds its domain to the loopback address to perform same-origin requests and access sensitive path information. This exposure can reveal local usernames and project layout details.