{"id":"EUVD-2026-64041","revision":null,"records":[{"revision":"aef74c45fab04af09c03190215802136","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63462","aliases":[],"title":"Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter","description":"Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.","state":0,"publishedAt":"2026-08-21T18:12:32.807+00:00","modifiedAt":"2026-08-25T17:33:23.689+00:00","affected":[{"ecosystem":"Vendor product","name":"unleash","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unleash\",\n                    \"product\": \"unleash\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 7.5.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 7.6.0, < 7.6.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.0.0, < 8.0.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp","https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf","https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1","https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d","https://github.com/Unleash/unleash/releases/tag/v7.5.2","https://github.com/Unleash/unleash/releases/tag/v7.6.5","https://github.com/Unleash/unleash/releases/tag/v8.0.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63462","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63462","identifiers":["CVE-2026-63462"]},"retained":false,"historicalAffected":[]},{"revision":"909b10bfe0f64885951033fd82730aa3","observedAt":"2026-11-09T14:13:06.565+00:00","statement":{"source":"euvd","id":"EUVD-2026-64041","aliases":["CVE-2026-63462","GHSA-r5pq-6chh-j3xp"],"title":"Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErro…","description":"Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp","https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf","https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1","https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d","https://github.com/Unleash/unleash/releases/tag/v7.5.2","https://github.com/Unleash/unleash/releases/tag/v7.6.5","https://github.com/Unleash/unleash/releases/tag/v8.0.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64041","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 21, 2026, 6:12:32 PM","dateUpdated":"Aug 25, 2026, 5:33:23 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-64041","identifiers":["EUVD-2026-64041","CVE-2026-63462","GHSA-r5pq-6chh-j3xp"]},"retained":false,"historicalAffected":[]},{"revision":"67040207a1b04e3788f0526f5ac58140","observedAt":"2026-10-25T15:18:45.851+00:00","statement":{"source":"nvd","id":"CVE-2026-63462","aliases":[],"title":"Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErro…","description":"Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.","state":0,"publishedAt":"2026-08-21T19:17:31.927+00:00","modifiedAt":"2026-10-14T19:10:00.297+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf","https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1","https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d","https://github.com/Unleash/unleash/releases/tag/v7.5.2","https://github.com/Unleash/unleash/releases/tag/v7.6.5","https://github.com/Unleash/unleash/releases/tag/v8.0.2","https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63462","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-674"],"productCriteria":[],"sourceDates":{"published":"2026-08-21T19:17:31.927","lastModified":"2026-10-14T19:10:00.297"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-63462","identifiers":["CVE-2026-63462"]},"retained":false,"historicalAffected":[]},{"revision":"dd1f83a839e844d190ad846865e7029a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-r5pq-6chh-j3xp","aliases":["CVE-2026-63462"],"title":"Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter","description":"## Summary\n\nAn unauthenticated `POST` to any OpenAPI-validated endpoint, including the anonymous `POST /edge/validate` and `POST /edge/issue-token`, crashes the entire Unleash server with one request body of deeply-nested JSON.\n\nWhen request-body validation fails, Unleash builds the error message by calling `JSON.stringify` on the raw offending value taken from the request body. A value nested a few thousand levels deep makes `JSON.stringify` recurse past the V8 call-stack limit and throw `RangeError: Maximum call stack size exceeded`.\n\nThe throw is synchronous inside an Express error-handling middleware that has no try/catch, and the process registers no `uncaughtException` handler (only `unhandledRejection`). Node terminates the process with `exit(1)`.\n\nThe body parser sets no JSON nesting-depth limit, the payload (about 10 KB at depth 5000) stays far under the 100 KB body-size limit, and the same error formatter serves every API route, so the trigger is route-independent.\n\nResult: a remote attacker with no account, token, or cookie takes the whole server offline with a single 10 KB request, and keeps it offline by replaying it.\n\n## Affected\n\nUnleash OSS server, confirmed live-exploitable on v8.0.0 (`unleashorg/unleash-server:8.0.0`).\nVulnerable code is the shared request-validation error path (`src/lib/error/bad-data-error.ts` `genericErrorMessage`), present on current `main`.\nReachable on a stock install: no feature flag, no setting, no authentication, no CSRF token, and no cookie required.\nThe 100 KB request-body size limit does not mitigate it; the crashing payload is about 10 KB.\n\n## Root cause\n\nOn validation failure the error formatter serializes the raw offending request value with an unguarded `const youSent = JSON.stringify(propertyValue)` (`src/lib/error/bad-data-error.ts:75`), where `propertyValue` is read straight from the request body via `lodash.get` (`bad-data-error.ts:123`). A deeply-nested array or object makes `JSON.stringify` recurse once per level and throw `RangeError: Maximum call stack size exceeded`. `fromOpenApiValidationErrors` (`bad-data-error.ts:158`) runs from the Express error middleware `openAPIValidationMiddleware` (`src/lib/routes/controller.ts:68`), which calls it with no try/catch (`controller.ts:70`), while the controller's own try/catch (`controller.ts:103`) wraps only the route handler. The process registers only `process.on('unhandledRejection')` (`src/lib/server-impl.ts:274`) and no `uncaughtException` handler, so the synchronous throw terminates Node with `exit(1)`. The same unguarded pattern exists at `fromJoiError` (`bad-data-error.ts:175`) and at `handleErrors` (`src/lib/routes/util.ts:42`), whose own comment records that `JSON.stringify(finalError.details)` \"also hangs\" (`util.ts:63`).\n\n## Reproduction\n\n`unleashorg/unleash-server:8.0.0` started from the repository `docker-compose.yml`, default config, no credentials, server at `http://localhost:4242`.\n\n1. A shallow body returns a normal 400 and the server stays up.\n\n```\ncurl -s -X POST http://localhost:4242/edge/validate \\\n  -H 'Content-Type: application/json' -d '{\"tokens\":[[]]}'\n# HTTP 400 BadDataError: \"The `/body/tokens/0` property must be string. You sent [].\"\n```\n\n2. A single anonymous body nested 5000 levels deep (10013 bytes) crashes the process.\n\n```\ncurl -s -o /dev/null -w '%{http_code}\\n' -X POST http://localhost:4242/edge/validate \\\n  -H 'Content-Type: application/json' \\\n  --data-binary \"$(python3 -c 'd=5000;print(\"{\\\"tokens\\\":[\"+\"[\"*d+\"]\"*d+\"]}\")')\"\n# 000  (connection dropped mid-response; Node exited)\n```\n\n3. The server is gone and does not recover on its own.\n\n```\ncurl -s -o /dev/null -w '%{http_code}\\n' http://localhost:4242/health\n# 000\ndocker inspect repo-web-1 --format '{{.State.Status}} restarts={{.RestartCount}}'\n# exited restarts=0\n```\n\nLive-verified: one anonymous 10013-byte request to `/edge/validate` drove `/health` from 200 to 000; the container logs showed the `RangeError` stack through `bad-data-error` and `openAPIValidationMiddleware`, and the process did not restart. The crash threshold is about 4000 to 4500 nesting levels; depth 5000 crashes reliably. The same crash reproduces on `POST /edge/issue-token` with a nested object, confirming route and shape independence.\n\n## Impact\n\n- Single 10 KB request with no account, token, or cookie takes the entire server offline.\n- Replaying the request (kilobits per restart interval) sustains a near-total outage; with no restart policy the first request is a permanent kill.\n- Feature-flag evaluation sits on the request path of dependent applications, so the outage propagates to them.\n- Every OpenAPI-validated endpoint is a trigger, including anonymous ones.\n\n## Credit\n\nJan Kahmen, [turingpoint](https://www.turingpoint.de) (jan@turingpoint.de)","state":0,"publishedAt":"2026-08-21T19:14:37+00:00","modifiedAt":"2026-08-21T19:40:58.188508+00:00","affected":[{"ecosystem":"npm","name":"unleash-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.5.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"unleash-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.6.0"},{"kind":"fixed","version":"7.6.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"unleash-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0"},{"kind":"fixed","version":"8.0.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp","https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf","https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1","https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d","https://github.com/Unleash/unleash","https://github.com/Unleash/unleash/releases/tag/v7.5.2","https://github.com/Unleash/unleash/releases/tag/v7.6.5","https://github.com/Unleash/unleash/releases/tag/v8.0.2"],"sourceUrl":"https://github.com/advisories/GHSA-r5pq-6chh-j3xp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-r5pq-6chh-j3xp","identifiers":["GHSA-r5pq-6chh-j3xp","CVE-2026-63462"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T00:04:20.9434546+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T00:04:20.9434546+00:00","lastSuccessAt":"2026-11-10T00:04:21.6223341+00:00","error":null,"lastVerifiedAt":"2026-11-10T00:04:21.622335+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-28cfe0e9a7fd540693c3c003e82e8794f6d50787cb7c9866f49d79161db1199f","complete":true,"records":421738,"lastAttemptAt":"2026-11-10T00:02:15.9105874+00:00","lastSuccessAt":"2026-11-10T00:02:15.7728836+00:00","error":null,"lastVerifiedAt":"2026-11-10T00:02:15.9105874+00:00","snapshotPublishedAt":"2026-11-09T23:23:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-712f6c1278224b899f49f24ee1b071dc","complete":false,"records":13689,"lastAttemptAt":"2026-11-10T00:17:10.7338694+00:00","lastSuccessAt":"2026-11-10T00:17:10.73+00:00","error":"42 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T00:17:10.73+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13662,"expectedIdentifiers":13742,"failedIdentifiers":42},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T00:04:20.9434546+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T00:04:20.9434546+00:00","lastSuccessAt":"2026-11-10T00:04:21.6231234+00:00","error":null,"lastVerifiedAt":"2026-11-10T00:04:21.6231235+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-46931e0d84a04da7b4a608d083ac3d63","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T00:04:49.7283608+00:00","lastSuccessAt":"2026-11-10T00:04:49.725+00:00","error":null,"lastVerifiedAt":"2026-11-10T00:04:49.725+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13704,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T00:04:20.2100924+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T00:04:20.2100924+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T00:02:15.9827084+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T00:02:15.9827084+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-761ecc9061239b0da572dc9254c6f384c1d19339eb08408c436647a2f26129e9","complete":true,"records":3064,"lastAttemptAt":"2026-11-10T00:04:20.8155249+00:00","lastSuccessAt":"2026-11-09T17:05:03.4044794+00:00","error":null,"lastVerifiedAt":"2026-11-10T00:04:20.8155249+00:00","snapshotPublishedAt":"2026-11-09T16:33:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-0238b66eb8569b8ca6bfb00e5ba7ca79562b7b754d90d8771d19caf3b72b4f1c","complete":true,"records":231580,"lastAttemptAt":"2026-11-10T00:04:10.424408+00:00","lastSuccessAt":"2026-11-10T00:04:09.9885069+00:00","error":null,"lastVerifiedAt":"2026-11-10T00:04:10.424408+00:00","snapshotPublishedAt":"2026-11-09T23:48:05+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}