# Valkey 8.0.12 patches heap buffer overflow in cluster Pub/Sub, 13 bug fixes

> **Key takeaway:** Valkey 8.0.12 fixes a critical heap buffer overflow in cluster Pub/Sub message construction that could enable remote code execution, alongside 13 stability and correctness fixes for streams, sorted sets, ACL parsing, and cluster configuration.

**Published:** 2026-10-26T23:37:35+00:00 
**Source:** Valkey In-Memory Datastore 
**Category:** databases-storage 
**Canonical URL:** https://fosswire.org/news/valkey-8012-patches-heap-buffer-overflow-in-cluster-pubsub-1.html 

## Summary
Valkey 8.0.12, released October 26, 2026, is a security-focused patch release for the open-source Redis fork that addresses a heap buffer overflow vulnerability in cluster-mode Pub/Sub message construction. The flaw, tracked as GHSA-f4q9-j22m-xqq9, could allow an authenticated client to execute arbitrary code by publishing an oversized message, prompting the maintainers to mark upgrade urgency as SECURITY with immediate application recommended.

Beyond the security fix, the release resolves 13 bugs spanning core data structures, module APIs, benchmarking tools, and cluster operations. Notable corrections include stream commands failing to invalidate WATCH and client-side tracking, RESTORE payload validation preventing server aborts, sorted set intersection handling of NaN weighted scores, and cluster configuration saving rewritten to avoid truncated nodes.conf files and SMB filesystem failures on platforms like Azure Files.

## What changes in Valkey 8.0.12
- **Security (GHSA-f4q9-j22m-xqq9):** Heap buffer overflow in cluster Pub/Sub message construction patched; authenticated clients could previously trigger arbitrary code execution via oversized published messages.
- **Stream command correctness:** XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, and XAUTOCLAIM now properly trigger WATCH invalidation and client-side tracking invalidation when mutating consumer-group or PEL state.
- **RESTORE payload hardening:** Payloads declaring string lengths that overflow allocation sizes are now rejected as bad data instead of causing server aborts.
- **Module API fixes:** ValkeyModule_FreeModuleUser, ValkeyModule_ACLAddLogEntry, and ValkeyModule_ACLAddLogEntryByUserName declarations corrected to return int as implemented, eliminating undefined behavior on strict call signature targets.
- **Cluster configuration reliability:** nodes.conf saving rewritten with lock file separated to nodes.conf.lock, preventing truncated files, startup lock loss, and SMB filesystem save failures including on Azure Files.

## Why it matters
For Linux distributions and cloud operators running Valkey in cluster mode, the Pub/Sub RCE fix demands immediate deployment to prevent authenticated attacker exploitation. The cluster config saving improvements directly benefit Azure Files and SMB-backed deployments that previously experienced silent configuration corruption, while the stream command tracking fixes restore correctness for applications relying on Redis-compatible optimistic locking patterns.