Supabase will drop four TLS 1.2 ciphers on 10 November
Project HTTP APIs stop offering CBC-mode cipher suites. Clients stuck on old TLS libraries will fail to connect, and the error won't show up in API logs.
Supabase will stop offering four TLS 1.2 cipher suites on project HTTP APIs from 10 November 2026 at the earliest: the two AES-128-CBC and two AES-256-CBC suites paired with ECDHE. The change hits Auth, the Data API, Storage, Realtime and Edge Functions on <project_ref>.supabase.co and custom domains. Direct Postgres connections, the connection pooler and the Management API are not affected.
Supabase says CBC-mode ciphers have known weaknesses and get flagged by security scanners, and that the affected traffic is under 0.0001% of the platform’s total. A client only breaks if it can’t negotiate TLS 1.3 and the only TLS 1.2 ciphers it shares with Supabase are the CBC ones being dropped, which in practice means an unsupported OS, an old runtime, or an embedded device that stopped getting updates.
Why it matters: the failure happens during the TLS handshake, before an HTTP request is even sent, so it won’t appear in your API logs. If you have any client, device or legacy service hitting a Supabase project, check its TLS library now rather than finding out on 10 November. Updating the OS, runtime or TLS library to support TLS 1.3 fixes it; routing through a proxy you control is the fallback if you can’t update the client itself.
The caveat: Supabase’s own date is “at the earliest”, so it could slip, and this is the exception, not the rule: it affects only clients that were already failing modern TLS best practice.