Supabase Drops Four TLS 1.2 Ciphers on Its APIs as Soon as Nov. 10

Supabase will stop offering four older TLS 1.2 cipher suites on its project HTTP APIs starting Nov. 10 at the earliest. Any client that supports nothing newer will lose access (Supabase changelog, Oct. 12, 2026).

What is going away

The four suites use CBC mode: ECDHE with ECDSA or RSA, paired with AES-128-CBC-SHA256 or AES-256-CBC-SHA384. Supabase said they “have known security weaknesses and often trigger warnings in security scans.”

The change covers <ref>.supabase.co and custom domains. Because Auth, the Data API, Storage, Realtime and Edge Functions are all sub-routes of the HTTP API, all five are affected. Direct Postgres connections, pooler connections and the Management API are not.

TLS 1.3 is unchanged. Supabase said it has supported only TLS 1.2 and 1.3 for several years. The TLS 1.2 suites that stay are the AES-GCM and ChaCha20-Poly1305 variants for both ECDSA and RSA certificates.

The timeline

Supabase published the notice Oct. 12 and said it would email affected customers on Oct. 14. The ciphers come out Nov. 10 “at the earliest.” The date can only move later. Owners of projects that received connections using the deprecated ciphers are being contacted directly.

Who is exposed

Supabase said fewer than 0.0001% of connections to its projects negotiated these ciphers in the past 30 days. It described the affected devices as running end-of-life software, such as old operating system installs or embedded products that no longer get updates.

Its migration advice is to find any HTTPS client of your project running on an end-of-life OS, an old browser or an embedded device, then update the OS or TLS library until it supports one of the remaining ciphers or TLS 1.3. Teams that need help can open a support ticket naming the client and the ciphers it needs.

The take

The odds that this hits you are low. Supabase’s own number says so. The risk is the device you forgot you deployed. Supabase points at old operating systems and embedded products that call your project’s HTTP API. Audit those first.

Watch for the Oct. 14 email. Supabase said it is contacting owners of projects that received these connections. If it arrives, you have four weeks.