ash_typescript CVE-2026-77856

The target application must be running ash_typescript between 0.11.0 and 0.17.x and must expose at least one RPC endpoint backed by an Ash resource that includes a TypedStruct-typed attribute with typescript_field_names/0 implemented, routing field selection through select_typed_struct_fields/4. No authentication is required (PR:N per CVSS vector). Exploitation is limited to the availability dimension - no data exfiltration or state modification is possible. Applications that do not expose TypedStruct-backed RPC endpoints, or that place those endpoints behind authentication, are not exploitable in the unauthenticated sense indicated by the vector. The CVSS 4.0 AT:P signal confirms that a specific deployment topology (the typed struct endpoint being reachable) must be present.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) scores 8.2, reflecting unauthenticated network exploitation with a high availability impact against the vulnerable system. The AT:P (Attack Requirements: Present) metric correctly encodes that the targeted application must expose an ash_typescript RPC endpoint with at least one TypedStruct type - a non-universal but entirely normal deployment configuration for any application built on this library. There is no EPSS score provided in the intelligence sources, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog; real-world exploitation probability is therefore inferred as moderate given the low attack complexity and zero authentication requirement. The impact is pure availability: no data is leaked and no state is modified, but a complete VM abort takes down every Elixir process in the node - not just the RPC handler - making this operationally equivalent to a hard crash. Because ash_typescript targets Elixir developers building API-backed applications, the affected population is technically sophisticated but relatively small; nonetheless, any internet-exposed instance running an affected version is trivially deniable by an automated scanner sending unique field name strings. Defenders should treat upgrade to 0.18.0 as urgent for any public-facing deployment, and operators running older releases behind authentication layers have materially reduced exposure due to the AT:P signal in the vector.

An unauthenticated attacker sends a high volume of RPC requests to an ash_typescript endpoint, each request specifying a TypedStruct field selection containing hundreds of globally unique, fabricated field name strings (e.g., randomly generated alphanumeric identifiers). Each unique string is converted to a permanent BEAM atom before field validation rejects the request; after sufficient requests, the atom table reaches its ceiling and the Erlang VM issues an abort, crashing the entire application node. No exploit code has been publicly identified, but the technique requires only standard HTTP tooling and knowledge of a valid typed struct endpoint path.