RUSTSEC-2026-0198: `Report::frames_mut` allows aliased mutable references

What to do

1. See which version you have: cargo tree -i error-stack (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p error-stack. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example error-stack = "0.8.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of this crate return an iterator from Report::frames_mut whose &mut Frame items have lifetimes independent of the iterator, so all yielded references can be held at the same time. A yielded frame's sources are also yielded by the iterator and reachable through the parent frame via Frame::sources_mut, allowing safe code to obtain two live mutable references to the same frame. This is undefined behavior and can be used to cause a segmentation fault (see reproducer in the linked issue). Versions 0.1.0 and 0.1.1 are affected through Frame::source_mut instead of Frame::sources_mut.

The flaw is fixed in 0.8.0 by replacing the iterator with internal iteration: Report::frames_mut now takes a visitor closure, so mutable access to a frame is scoped and cannot overlap with access to its sources.

References

• Package: crates.io/crates/error-stack
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0198.html
• Report: github.com/hashintel/hash/issues/8945
• Web: github.com/hashintel/hash/pull/8946

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.