---
id: CVE-2026-50013
title: Hoverfly is an open source API simulation tool
summary: >-
  Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when
  Hoverfly is running in Diff mode, the `AddDiff()` function writes to the
  shared `responsesDiff` map without any synchronization (no mutex). When
  multiple proxy…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-362
  - CWE-820
vendor: SpectoLabs
product: hoverfly
affected:
  - hoverfly < 1.12.8
patched:
  - github.com/SpectoLabs/hoverfly 1.12.8
published: '2026-09-11'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T19:17:24.620'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50013'
references:
  - url: 'https://github.com/SpectoLabs/hoverfly/pull/1227'
    label: security-advisories@github.com
  - url: 'https://github.com/SpectoLabs/hoverfly/releases/tag/v1.12.8'
    label: security-advisories@github.com
  - url: >-
      https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-qrh4-p6v4-mrfg'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
epss: 0.0047
epssPercentile: 0.38086
aliases:
  - GHSA-qrh4-p6v4-mrfg
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T17:06:19.894343Z'
ingestedAt: '2026-07-14T18:38:32.951Z'
---

## Overview

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-50013)

Affected packages:

- `github.com/SpectoLabs/hoverfly <= 1.12.7`

Patched in:

- `github.com/SpectoLabs/hoverfly 1.12.8`

Source: https://github.com/advisories/GHSA-qrh4-p6v4-mrfg