{"id":"EUVD-2026-64041","enisaUuid":"5b44ff5f-5a1a-39d6-87c9-d62de277b060","description":"Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.","datePublished":"Aug 21, 2026, 6:12:32 PM","dateUpdated":"Aug 25, 2026, 5:33:23 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp\nhttps://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf\nhttps://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1\nhttps://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d\nhttps://github.com/Unleash/unleash/releases/tag/v7.5.2\nhttps://github.com/Unleash/unleash/releases/tag/v7.6.5\nhttps://github.com/Unleash/unleash/releases/tag/v8.0.2\n","aliases":"CVE-2026-63462\nGHSA-r5pq-6chh-j3xp\n","assigner":"GitHub_M","epss":0.7,"enisaIdProduct":[{"id":"2106f3ec-3600-3db6-8845-ee4288e83b95","product":{"name":"unleash","vendor":{"name":"Unleash"}},"product_version":"7.6.0, \u003c 7.6.5"},{"id":"d9797ff4-da74-30c1-a2f3-d72cfff63067","product":{"name":"unleash","vendor":{"name":"Unleash"}},"product_version":"8.0.0, \u003c 8.0.2"},{"id":"de5bab99-8f81-3087-9b4f-892de266fec9","product":{"name":"unleash","vendor":{"name":"Unleash"}},"product_version":"\u003c 7.5.2"}],"enisaIdVendor":[{"id":"a47c42cc-0b8d-368d-b87d-e52244148049","vendor":{"name":"Unleash"}}],"enisaIdVulnerability":[{"id":"30793c03-405d-38f2-8a40-f22787307b1d","vulnerability":{"id":"CVE-2026-63462","description":"Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.","datePublished":"Aug 21, 2026, 6:12:32 PM","dateUpdated":"Aug 25, 2026, 5:33:23 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp\nhttps://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf\nhttps://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1\nhttps://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d\nhttps://github.com/Unleash/unleash/releases/tag/v7.5.2\nhttps://github.com/Unleash/unleash/releases/tag/v7.6.5\nhttps://github.com/Unleash/unleash/releases/tag/v8.0.2\n","enisa_id":"EUVD-2026-64041\n","assigner":"GitHub_M","epss":0.7,"dataProcessed":"Nov 1, 2026, 7:16:30 AM","vulnerabilityProduct":[{"id":"483d9f32-9313-3eb8-bccb-b12f230f6c3b","product":{"name":"unleash","vendor":{"name":"Unleash"}},"product_version":"7.6.0, \u003c 7.6.5"},{"id":"5f5d3261-8c16-3287-8d35-18898f1a7d77","product":{"name":"unleash","vendor":{"name":"Unleash"}},"product_version":"\u003c 7.5.2"},{"id":"a0b59bfe-01ce-3ff8-a463-0b23e9ad1028","product":{"name":"unleash","vendor":{"name":"Unleash"}},"product_version":"8.0.0, \u003c 8.0.2"}],"vulnerabilityVendor":[{"id":"4ee165f3-d6ea-39a2-9e66-e7e2d571e8b0","vendor":{"name":"Unleash"}}]}},{"id":"762e3289-af7e-399c-a924-e0ed276f7acb","vulnerability":{"id":"GHSA-r5pq-6chh-j3xp","description":"Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter","datePublished":"Aug 21, 2026, 7:14:37 PM","dateUpdated":"Aug 21, 2026, 7:14:37 PM","baseScore":0.0,"references":"https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp\nhttps://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf\nhttps://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1\nhttps://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d\nhttps://github.com/Unleash/unleash\nhttps://github.com/Unleash/unleash/releases/tag/v7.5.2\nhttps://github.com/Unleash/unleash/releases/tag/v7.6.5\nhttps://github.com/Unleash/unleash/releases/tag/v8.0.2\n","enisa_id":"EUVD-2026-64041\n","aliases":"CVE-2026-63462\nGHSA-r5pq-6chh-j3xp\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}