News · written 13 November 2026. A summary for readers, not technical advice — check the sources at the end for the details.

On 12 November 2026 the PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25, an update for every supported version. It fixes 52 security vulnerabilities and over 140 bugs reported in the last several months. If you run PostgreSQL yourself — for a website, an app or a home server — this is one to install.

The security fixes

Many of the 52 issues are rated 8.8 on the CVSS v3.1 scale, and most of those are described as flaws that could execute arbitrary code. A few examples from the announcement:

• CVE-2026-116314 — pg_restore could run arbitrary code when restoring a crafted non-plain archive (8.8).
• CVE-2026-116318 — a crafted not-null constraint name allowed SQL injection through pg_dump (8.8).
• CVE-2026-14661 — dblink and subscriptions could append to arbitrary files (8.1).
• Several fixes in plperl, pltcl, dblink and full-text search functions.

The full list, with a page per CVE, is on the PostgreSQL security page.

PostgreSQL 14 is now end-of-life

14.25 is the final release of PostgreSQL 14. It will no longer receive security or bug fixes. If you still run 14 in production, the project suggests you plan an upgrade to a newer, supported version.

Updating

A minor update like this one does not need a dump and reload or pg_upgrade: stop PostgreSQL and update its binaries. The announcement lists a few things to check afterwards:

• Some fixed bugs could leave GIN indexes, or GiST indexes using gist_trgm_ops (pg_trgm), returning wrong results. Reindex them if you suspect they are affected.
• If you use incremental backups, take a new full backup after updating and build on that one.
• B-tree indexes on bpchar columns declared without a length should be reindexed; columns declared as char(n) are not affected.
• If you skipped earlier update releases, read their release notes for any extra steps.

PostgreSQL 19 is close

The same day brought PostgreSQL 19 RC 2, the second release candidate. General availability is planned for 19 November 2026, unless an issue requires a delay or another release candidate. If you created JSON_ARRAY() or JSON_OBJECT() expression indexes while testing RC 1, drop or redefine them before upgrading. More in our earlier article, PostgreSQL 19 is almost here.

Sources

• PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released! (postgresql.org, 12 November 2026)
• PostgreSQL security information
• Versioning policy and release notes

More news at https://jmtechpower.com/articles.