Read the docs
TI-2026-45230 Aliases CVE-2026-63462GHSA-r5pq-6chh-j3xp

Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Priority HIGH 72CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-674.

Summary

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00699 53rd percentileScored 2026-11-07
Fix Fixed unleash (Unleash): 7.5.2, 7.6.5, 8.0.2unleash-server (npm): 7.5.2, 7.6.5, 8.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Unleashunleashbefore 7.5.2; 7.6.0 to before 7.6.5; 8.0.0 to before 8.0.27.5.2, 7.6.5, 8.0.2Patch availableCNA
—unleash-server (npm)before 7.5.27.5.2Patch availableGHSA-r5pq-6chh-j3xp
—unleash-server (npm)7.6.0 to before 7.6.57.6.5Patch availableGHSA-r5pq-6chh-j3xp
—unleash-server (npm)8.0.0 to before 8.0.28.0.2Patch availableGHSA-r5pq-6chh-j3xp
  • unleash VendorUnleash Affected before 7.5.2; 7.6.0 to before 7.6.5; 8.0.0 to before 8.0.2 Fixed in 7.5.2, 7.6.5, 8.0.2 Patch available CNA
  • unleash-server (npm) Vendor— Affected before 7.5.2 Fixed in 7.5.2 Patch available GHSA-r5pq-6chh-j3xp
  • unleash-server (npm) Vendor— Affected 7.6.0 to before 7.6.5 Fixed in 7.6.5 Patch available GHSA-r5pq-6chh-j3xp
  • unleash-server (npm) Vendor— Affected 8.0.0 to before 8.0.2 Fixed in 8.0.2 Patch available GHSA-r5pq-6chh-j3xp

Remediation

  • Fix · CNA unleash (Unleash) Fixed in 7.5.2, 7.6.5, 8.0.2
  • Fix · GHSA-r5pq-6chh-j3xp unleash-server (npm) Fixed in 7.5.2 Advisory →
  • Fix · GHSA-r5pq-6chh-j3xp unleash-server (npm) Fixed in 7.6.5 Advisory →
  • Fix · GHSA-r5pq-6chh-j3xp unleash-server (npm) Fixed in 8.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63462
  2. 2026-10-03 Alias added: GHSA-r5pq-6chh-j3xp

References

Other 8

  • TI-2026-45005 Server-side request forgery in unleash CVSS 3.1MEDIUM 5.5
  • TI-2026-53733 Unleash: Clone-feature lets a user copy a feature from a project they cannot read CVSS 4.0MEDIUM 5.3
  • TI-2026-54010 Authorization bypass in unleash CVSS 3.1MEDIUM 4.3
  • TI-2026-54011 Unleash: Missing await on permission check + cross-project IDOR in admin API CVSS 4.0HIGH 7.1
  • TI-2026-45232 Improper output encoding in unleash CVSS 3.1MEDIUM 4.1
  • TI-2026-53732 Unleash: CR-approval email renders user-controlled raw HTML CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences