The PostgreSQL Global Development Group has released new versions of the open-source database on 12 November 2026, fixing 52 security vulnerabilities and more than 140 other bugs across every supported version. The releases are PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25, and the same day also brought the second release candidate of the forthcoming PostgreSQL 19.

The scale of the update is unusually large. Thirty-two of the 52 flaws carry a CVSS score of 8.8, the highest in the batch, while the lowest-scored flaw, a way around the EXECUTE privilege on cast functions, scores 3.1. Most of the code execution flaws are memory errors or type confusion, where PostgreSQL handles a value as the wrong data type. They turn up in PL/Perl and PL/Tcl, in text search functions such as ts_rank_cd(), in parallel query, logical replication, dblink and statistics import. In many cases an authenticated database user, or a user able to create objects, could run code as the operating-system account behind the database server. One named flaw, CVE-2026-6460, is a type confusion reachable through ALTER ... SET DATA TYPE and similar statements.

Client tools are affected too

The fixes are not limited to the server. The pg_dump utility had a SQL injection flaw through not-null constraint names, and its tar-format restore script failed to block psql command injection. The reindexdb tool mishandled quoting of index names. Anyone who runs these tools against databases where other users can create and name objects should update the client binaries along with the server, or the patch leaves a way back in.

Some fixes need work after the upgrade

Installing the new binaries is only part of the job. Several of the fixed bugs can leave indexes corrupt, so administrators should reindex GIN indexes suspected of corruption, pg_trgm GiST indexes that use gist_trgm_ops, and B-tree indexes on bpchar columns declared without a length. Tables that throw missing chunk number errors need a full REINDEX TABLE. Anyone using incremental backups should take a new full backup and base later incremental backups on it, because some of the fixed bugs could produce corrupt backups.

PostgreSQL 14 reaches the end of the road

Version 14.25 is the final release of PostgreSQL 14, which will receive no further security or bug fixes. The project supports each major version for five years and then ships one last minor release; PostgreSQL 14 first shipped on 30 September 2021, so this is where that clock runs out. Any vulnerability found in version 14 from now on will stay unfixed, so servers still running it in production need a plan to move to a supported version.

PostgreSQL 19 release candidate 2 shipped alongside the security releases, with general availability planned for 19 November 2026. Testers should note that the release candidate reverts support for JSON_ARRAY() and JSON_OBJECT() over arrays, composite types and range types in expression indexes, generated columns and partition keys, and objects built that way have to be dropped or redefined before upgrading.

No exploitation of these flaws had been reported when the release landed, and no public exploit code had been found. That is no reason to wait: the vulnerabilities are now public, the fixes are available, and unpatched servers are exposed. Database owners should check which version they run and apply the update, starting with any system that is reachable from the internet or shared with untrusted users.