Supabase rolls out PostgreSQL 15.19 and 17.11 with 44 CVE fixes

Supabase is rolling out PostgreSQL 15.19 and 17.11, a minor-release upgrade that closes 44 CVEs across five upstream security cycles. The platform’s September 25 changelog says existing projects should expect the upgrade in the dashboard on September 28; new projects will use the patched versions from that date.

The release is not a routine version bump for every workload. Supabase flags four areas that can require operator action: ltree indexes, legacy PGP data handled through pgcrypto, btree_gist indexes on floating-point columns containing NaN, and custom operators with non-built-in selectivity estimators.

What PostgreSQL 15.19 and 17.11 change

The upstream PostgreSQL notes confirm the fixes behind the rollout. One security change, CVE-2026-14663, stops pgcrypto from decrypting data written with Blowfish or CAST5 after the upgrade. PostgreSQL explains that unsupported cipher handling can otherwise make stored data appear to have been protected when it was not.

The releases also address an integer overflow in ltree comparisons and correctness issues affecting multibyte or ICU-backed databases. Supabase warns that affected ltree indexes can return incomplete results until they are reindexed. It also calls out btree_gist indexes on float columns containing NaN, which may need rebuilding.

The September 28 Supabase upgrade window

Supabase says existing projects will see the upgrade in the dashboard on September 28, while newly created projects will be created on PostgreSQL 15.19 or 17.11 from that date. The changelog includes detection queries so teams can determine whether their schema or stored data matches one of the affected patterns.

This is an upgrade-readiness task, not a blanket instruction to reindex every database. Run the vendor’s checks against a representative copy or maintenance workflow, review application behavior around encrypted values, and schedule any required reindexing with the normal operational safeguards. If your project uses custom operators, include dump/restore and branching workflows in the review because the new permission requirement can surface there.

What database teams should verify

• Whether databases use multibyte encodings or ICU/builtin collations with ltree indexes.
• Whether pgcrypto data depends on Blowfish or CAST5 decryption.
• Whether btree_gist indexes cover floating-point columns that can contain NaN.
• Whether custom operators rely on non-built-in selectivity estimators.

Supabase says an empty result from its detection queries means no action is required for that check. The PostgreSQL release notes remain the authoritative reference for the upstream fixes; Supabase’s operational guidance determines how the managed rollout affects hosted projects.

For teams maintaining AI-backed applications, this is infrastructure hygiene with a short deadline: database compatibility checks belong in the deployment plan before the September 28 rollout, especially where encrypted records, search paths, or index-heavy workloads are involved.

Sources and methodology

This report uses the Supabase changelog as the primary platform source and cross-checks the affected fixes against the independent PostgreSQL 15.19 release notes and PostgreSQL 17.11 release notes. It does not infer that every Supabase project requires manual remediation.