Terraform v1.15.9 Fixes Child Module Validation and Addresses Security Vulnerability
Terraform v1.15.9 has been released, providing important bug fixes and security updates. This patch resolves an issue with child module validation, ensuring that invalid blocks for list, import, backend, and cloud configurations now correctly raise errors or warnings. Additionally, it updates `go-slug` to mitigate CVE-2026-14978, a Unicode normalization vulnerability. This security fix prevents `.terraformignore` files from being bypassed when uploading configurations to Terraform Enterprise or HCP Terraform during a run.
Fixes (1) ›
- validate
Child module validation has been fixed and will now raise errors or warning diagnostics for invalid blocks. (list, import, backend, and cloud)
Notes (1) ›
Update go-slug to v0.18.3 to mitigate CVE-2026-14978, which is a Unicode normalization issue that could lead to files not being correctly excluded via .terraformignore from upload to a Terraform Enterprise or HCP Terraform during a run
https://github.com/hashicorp/terraform/releases/tag/v1.15.9
Related releases
- Packer v1.16.0 Adds SLSA Provenance Verification and HCL2 Features HashiCorp Blog ·
- HCP Terraform: Control Plane for AI Infrastructure Automation HashiCorp Blog ·
- Consul Enterprise 2.0: CyberArk integration for external CA in service mesh HashiCorp Blog ·
- Terraform AzureRM Provider 5.0 Released HashiCorp Blog ·
- Terraform Enhances Resiliency, Governance, and Scalability HashiCorp Blog ·
- Terraform Stacks simplify infrastructure management HashiCorp Blog ·