CVE-2026-24874 is a critical type confusion flaw (CVSS 9.1) in xray-monolith. The NVD record says builds before 2025.12.30 are affected. The linked pull request applies an upstream LuaJIT patch to the bundled copy, so update to a build that includes it.
What's affected
- Affected: xray-monolith before 2025.12.30, per the NVD record.
- Fixed in: the pull request was merged on 30 December 2025. Check the project's release page to match a build to it.
The pull request is titled "Potential Vulnerability in Cloned Code". It names the affected function as lj_debug_getinfo() in the bundled LuaJIT sources and says it applies the same fix the upstream LuaJIT project made. The pull request also references CVE-2019-19391, the upstream issue.
How to check if you're exposed
If you installed a packaged build, look at its release date or version string. Anything before 2025.12.30 is in range. If you build from source, check that your tree contains the merged pull request, number 399.
If you maintain a project that vendors a copy of another library, run a search for the same function in your own tree. Cloned code is the reason this CVE exists. The upstream fix did not reach the copy until someone sent a patch.
What to do now
- Update xray-monolith to a build dated 2025.12.30 or later.
- If you ship mods or tools that embed their own LuaJIT, compare them with the upstream fix.
- Only load Lua scripts from sources you trust until you have updated.
Why it matters
Type confusion, covered by CWE-843 (Type Confusion), means code treats an object as a different type from the one it really is. In an interpreter that can corrupt memory. The lesson is about copied code. A vendored library does not get upstream fixes on its own, and scanners that only read package manifests will not see it.
Quick check
Is CVE-2026-24874 on the CISA KEV list?
No. The record marks it as not known exploited.
Sources
Last reviewed: 19 October 2026.
