Hopefully you've been reached about the Erlang security issue for the SSH app. It hits all Erlang versions and fixes are available for recent versions. It is about as bad as vulnerabilities come in terms of scope. Unauthenticated Remote Code Execution.

This is relevant to all Nerves systems and you should update immediately. You may have already mitigated the real risk if you turn off nerves_ssh for production systems or if your systems run in internal networks and only communicate via VPN. Among production Nerves devices none of the ones I have talked to are really exposed to this issue, thankfully. But do update, it matters for your defense in depth even if one of your layers currently protect your devices.

If using a custom system you have nerves_system_br v1.30.1 you can update to. If you are using one of the main systems, look below and grab the updated version. They've all been updated.

Project updates

nerves_system_br, v1.30.1

This is a security fix update to v1.30.0. Please see the Erlang release notes.

This fixes CVE-2025-32433 which allows for unauthenticated access via SSH. If you are using SSH in production, please update your nerves_system_br dependency to this or later. If using an officially supported Nerves system, the latest versions all have this update.

• Package updates
  • Erlang/OTP 27.3.3

Systems

• kiosk_system_rpi5, v0.3.1
• kiosk_system_rpi4, v0.3.1
• nerves_system_rpi4, v1.30.1
• nerves_system_rpi3a, v1.30.1
• nerves_system_rpi3, v1.30.1
• nerves_system_rpi2, v1.30.1
• nerves_system_rpi0, v1.30.1
• nerves_system_rpi, v1.30.1
• nerves_system_mangopi_mq_pro, v0.12.1
• nerves_system_vultr, v0.27.1
• nerves_system_x86_64, v1.30.1
• nerves_system_grisp2, v0.14.1
• nerves_system_osd32mp1, v0.21.1
• nerves_system_bbb, v2.26.1
• nerves_system_rpi5, v0.5.1

Other updates

nerves_hub_link, v2.7.3

• Fixed
  • Fix pattern match for :disksup.get_disk_data()

nerves_hub_link, v2.7.2

• Fixed

  • Retrieve disk info differently based on OTP version
  • Emit a warning when trying to retrieve public certs through Erlang on < OTP 25
  • Revert Backoff/Certificate move to fix breaking change
     

• Updated

  • Force whenwhere 0.1.2 to fix compatibility with OTP 24 and earlier

nerves_logging, v0.2.3

• Changes
  • Fix log message metadata and logging function call so log filtering works as documented. This also improves the docs.
  • General documentation and public API cleanup. This removes log parsing modules from the public API since they’re not intended to be called directly.

nerves_livebook, v0.15.6

• Fixes
  • Fix regression causing an UndefinedFunctionError for Mix.install_project_dir/0. Thanks to @gworkman for quickly reporting

nerves_livebook, v0.15.5

• Updates
  • Update to Livebook v0.15.5
  • Update Nerves systems to nerves_system_br v1.30.0
  • Update all dependencies

circuits_quickstart, v0.13.0

• Updates
  • Update Nerves systems to nerves_system_br v1.30.0

Participating in the community

The Nerves community is found wherever Elixirists gather. Try any of the following:

Questions are best asked on the Elixir Forum.

Social conversation and banter:

• Elixir Slack, #nerves channel
• Elixir Discord, #nerves channel

How you can help Nerves

Contribute in the way that works for you:

• Send corrections or improvements for documentation wherever it fails to help you.
• Write about Nerves, give talks about Nerves. Make videos about Nerves. It is all good.
• Write or port a new hardware library and include it in the Elixir Circuits collection.
• Get in touch about taking over maintenance duties for some libraries, we might be able to provide you hardware.
• Apply for an EEF stipend on something Nerves-related and build it. We can help if you have questions about this.

Finally, if you have questions about the newsletter or want to suggest something you can simply respond to this email.

- Lars