HAPI FHIR Software Vulnerabilities Discovered
Four flaws in version 8.10.0 expose patient records and memory, with a fix expected from Smile Digital Health in November.
Updated on Oct. 23, 2026 in Cybersecurity
Live Poll
Do you trust that healthcare software companies are doing enough to protect your private medical records?
Security researchers have identified four vulnerabilities in HAPI FHIR version 8.10.0 that could expose clinical records or lead to system outages. The Cybersecurity and Infrastructure Security Agency released four CVE advisories regarding these flaws on October 22, 2026, though no evidence of active exploitation exists.
Why it matters
These vulnerabilities expose critical weaknesses in healthcare interoperability software that supports data exchange for millions of patients. Because Smile Digital Health software serves over 110 million Americans, securing these implementations is essential to maintaining data privacy and system availability.
The flaws affect 190 global implementations, with CVE-2026-113873 allowing unauthenticated memory exhaustion via compressed payloads. CVE-2026-113874 impacts multi-tenant configurations by failing to verify user authorization against partition headers.
The players
Smile Digital Health
A provider of health data interoperability platforms whose software manages clinical information for over 110 million Americans.
Cybersecurity and Infrastructure Security Agency
The U.S. federal agency responsible for identifying and mitigating national cybersecurity risks, including those within critical health infrastructure.
The details
The vulnerabilities function by exploiting flaws in how the software handles data requests and system resources. CVE-2026-113874 specifically targets systems using header-based partition routing—a method of directing data packets based on labels in the request—by skipping authorization checks for those partitions. Meanwhile, CVE-2026-113873 functions as a denial-of-service vector where small payloads are decompressed to inflate memory usage, causing server crashes before the system can authenticate the request.
Timeline
May 2026: Smile CDR 2026.05.R01 version was released.
October 22, 2026: CISA issued four CVE advisories for the vulnerabilities.
November 2026: Smile Digital Health scheduled to release a software update.
The Tech Race
This discovery highlights the fragility of centralized health data infrastructure, following the pattern of disruption seen in the 2024 Change Healthcare cyberattack. It marks a critical preemptive identification of technical flaws within the supply chain of healthcare data exchange.
Healthcare organizations utilizing HAPI FHIR version 8.10.0 must audit their multi-tenant configurations to prevent unauthorized record access. Administrators should prepare to patch these systems in November to resolve memory exhaustion risks and secure patient data.
The takeaway
This discovery underscores the necessity of rigorous authorization validation in multi-tenant health software. System administrators should track the November 2026 software update release from Smile Digital Health as the primary resolution for these vulnerabilities.
What happens next
Smile Digital Health is scheduled to release a software update and supporting documentation in November 2026, which will specifically include a fix for the CVE-2026-113873 memory exhaustion vulnerability.
Further reading
For more on securing national health infrastructure, visit the Cybersecurity section.
Live Poll
Do you trust that healthcare software companies are doing enough to protect your private medical records?
