Security Fixes and Raw JSON Patch

TerminusDB 12.0.9 is a security release. All users are recommended to update to v12.0.9 or later. It was released on 28 October 2026.

Security fixes — stricter access checks for the apply, patch and diff APIs, and harder JWT claim validation.
Apply and patch for raw JSON — schemaless raw_json documents now work with apply and patch.
Date intervals — canonical ISO 8601 interval semantics, timezone offsets and typecasting with xdd:dateRange.

Security fixes

What changed

Fixed an issue (CVSS 7.5/6.5) that allowed users with read access to a database to use the apply API. Reported by @Santoshkumarpuppala. See the advisory GHSA-pg23-jx8g-vq9w.
The path-less api_patch/6 and api_diff/6 endpoints now require read access on at least one database. This prevents anonymous resource exhaustion.
Hardened JWT claim validation against type confusion (CVE-2026-25537) (#2597).

Why it matters

If several users share your server, and some of them have read-only access, the apply API fix makes sure those users cannot use apply. If your server is reachable from the internet, the patch and diff change stops anonymous callers from using these endpoints. If you use JWT authentication, the claim validation is now stricter.

We recommend that you upgrade, especially for multi-user or internet-exposed servers.

Read more: Access control · Troubleshooting authentication

Apply and patch for raw JSON

Apply and patch now work on schemaless (raw_json) documents (#2571).

Read more: Patch endpoint · JSON diff and patch

Date intervals

TerminusDB now uses canonical ISO 8601 interval semantics, with timezone offsets and typecasting with xdd:dateRange (#2574).

Fixes

Intervals handling improvements (#2569)
Denied JWT-scoped authorization now returns 403 access_not_authorised instead of crashing. The caller falls back to anonymous capabilities.

Also:

Removed a dead anonymous guard from api_info. Community serves the info payload to any caller, including anonymous. Enterprise redacts it for anonymous callers.
Pinned terminus-store to v0.21.8 for forward-compatible pack import, to prepare for faster intervals (#2568)
Quieter GC plugin logging and JWT opt-in at runtime (#2573)
Dependency bumps (#2581, #2598, #2599, #2600)

Upgrade

Example: Bash

docker pull terminusdb/terminusdb-server:v12.0.9

Docker install guide · Full changelog on GitHub

Previous: TerminusDB 12.0.8: UUID v7 Keys and Faster JSON Loading · All 12.0 releases: TerminusDB 12.0 changelog · Release index

TerminusDB 12.0.9: Security Fixes and Patch for Raw JSON Documents