# Supabase product-fb677bb213 — Release & Upgrade Intelligence
- **Product:** Supabase (https://supabase.com)
- **Version:** product-fb677bb213
- **Released:** Sep 25, 2026
- **Impact Score:** 9/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/supabase/updates/product-fb677bb213/

## Executive Summary (TL;DR)
Supabase rolled out PostgreSQL 15.19 / 17.11 minor releases closing 44 CVEs, which introduce breaking behavior changes requiring index reindexing for ltree and btree_gist extensions, pgcrypto decryption failures for legacy ciphers, and superuser restrictions for custom operators. Users must run detection queries and migrate affected database objects.

## Improvements
- Upgraded PostgreSQL to 15.19 / 17.11 closing 44 upstream CVEs
- Case-folding fixes and integer-overflow fixes for deep ltree values
- Correctness fixes for btree_gist indexes on float columns containing NaN

## Bug Fixes
- Fixed CVE-2026-14663 where pgcrypto legacy ciphers (bf, blowfish, cast5) allowed decryption even with incorrect passphrases
- Fixed CVE-2026-2004 restricting non-built-in selectivity estimators on custom operators to superusers