EUVD-2026-64041
GHSA-r5pq-6chh-j3xp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated endpoint, trivially triggered with no complexity, yields full process termination with no confidentiality or integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.
AnalysisAI
Stack exhaustion denial-of-service in Unleash's OpenAPI validation middleware allows unauthenticated network attackers to terminate the Node.js server process by submitting a roughly 10 KB JSON payload nested thousands of levels deep to any OpenAPI-validated endpoint. Versions prior to 7.5.2, 7.6.5, and 8.0.2 are affected; the shared error-formatting path in src/lib/error/bad-data-error.ts calls JSON.stringify on raw request values without catching the resulting RangeError, which propagates uncaught and kills the process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The targeted Unleash endpoints - POST /edge/validate, POST /edge/issue-token, and any other OpenAPI-validated route - must be network-reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately reflects the real-world risk profile: no authentication, no special client state, and no user interaction are required - a single crafted POST to a publicly-routable Unleash endpoint is sufficient to terminate the server process. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Unleash 7.5.2, 7.6.5, or 8.0.2, which are available at https://github.com/Unleash/unleash/releases/tag/v7.5.2, https://github.com/Unleash/unleash/releases/tag/v7.6.5, and https://github.com/Unleash/unleash/releases/tag/v8.0.2 respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Unleash deployments and identify affected versions (7.5.x before 7.5.2, 7.6.x before 7.6.5, 8.0.x before 8.0.2). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) all
Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first mome
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today