CVE-2026-63462 in Unleash
Summary
by MITRE • 08/21/2026
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified within Unleash, an open-source feature management platform, represents a critical server-side denial of service condition stemming from improper input validation and lack of depth limiting in the OpenAPI error handling middleware. Specifically, the flaw resides in src/lib/error/bad-data-error.ts, where shared logic for processing validation errors fails to guard against stack exhaustion when serializing deeply nested data structures. The core technical issue involves the interaction between lodash.get and JSON.stringify within the genericErrorMessage and fromOpenApiValidationErrors functions. When a request triggers an OpenAPI validation error, these functions attempt to serialize parts of the raw request payload using JSON.stringify without first checking or limiting the depth of the object graph being traversed. This design oversight allows an attacker to craft malicious payloads that exploit the recursive nature of JavaScript's default serialization mechanism, which relies on the call stack to traverse nested objects and arrays.
An unauthenticated actor can leverage this flaw by sending a specifically crafted JSON payload containing approximately ten kilobytes of data structured with thousands of levels of nesting to any endpoint protected by OpenAPI validation, such as POST /edge/validate or POST /edge/issue-token. Upon receiving this request, the application attempts to process it and subsequently generate an error response due to other inherent validation failures in the payload structure. During the generation of this error message, the system invokes JSON.stringify on the deeply nested raw value extracted via lodash.get. Because JavaScript engines have a finite call stack size, typically ranging from a few thousand frames depending on the environment configuration, the recursive traversal required by JSON.stringify quickly exceeds this limit. This results in a RangeError: Maximum call stack size exceeded exception being thrown within the openAPIValidationMiddleware function.
The operational impact of this vulnerability is severe due to the architecture of Node.js applications running Unleash. The uncaught exception generated by the stack overflow terminates the entire Node process because there are no configured unhandledException handlers capable of recovering from such a critical runtime error in this context. Consequently, a single successful exploit attempt causes an immediate and complete service outage for all users relying on the feature management platform. Furthermore, since the vulnerability is triggered via standard HTTP endpoints accessible without authentication, it can be exploited remotely by any internet user or internal network actor with access to the API surface. The persistence of this impact allows for sustained denial of service through simple request replay attacks, effectively rendering the application unavailable until the process is manually restarted or a new instance is provisioned.
This vulnerability aligns with CWE-787: Out-of-bounds Write in terms of memory corruption principles, although more specifically it maps to CWE-400: Uncontrolled Resource Consumption, as the attacker forces the system to consume excessive computational resources leading to resource exhaustion and service failure. In the context of the MITRE ATT&CK framework, this behavior is consistent with T1499: Endpoint Denial of Service, where an adversary disrupts availability by exhausting system or network resources. The lack of input sanitization regarding structural depth constitutes a significant deviation from secure coding practices recommended for handling untrusted data in server-side applications.
To mitigate this vulnerability and prevent recurrence, it is imperative to upgrade Unleash to version 7.5.2, 7.6.5, or 8.0.2, where the developers have implemented safeguards against stack exhaustion during error serialization. For environments unable to immediately patch, defensive measures should include implementing a global unhandledException handler that logs the error and gracefully restarts the process rather than allowing it to crash silently, although this is only a partial mitigation as service interruption still occurs. Additionally, input validation layers should enforce strict limits on JSON depth or object complexity before any processing or serialization attempts are made. Developers must ensure that all recursive operations involving untrusted data include explicit depth counters or use iterative alternatives to prevent stack overflow conditions in production environments.