Serverless Todo
Monthly
Uncontrolled resource consumption in evanchiu/serverless-todo (versions 1.0.3 and 2.0.0) allows remote unauthenticated attackers to exhaust compute or memory resources by sending crafted payloads to the API Todo Endpoint's saveTodos function. The vulnerability stems from unsanitized processing of the event.body argument in src/index.js without input size or rate limits. A public proof-of-concept is available via a GitHub issue; no patch has been released and the maintainer has not responded to the disclosure.
Uncontrolled resource consumption in evanchiu/serverless-todo (versions 1.0.3 and 2.0.0) allows remote unauthenticated attackers to exhaust compute or memory resources by sending crafted payloads to the API Todo Endpoint's saveTodos function. The vulnerability stems from unsanitized processing of the event.body argument in src/index.js without input size or rate limits. A public proof-of-concept is available via a GitHub issue; no patch has been released and the maintainer has not responded to the disclosure.