CVE-2026-63462
Received Received - Intake

Uncontrolled Stack Exhaustion in Unleash OpenAPI Validation

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-63462
EUVD
EUVD-2026-64041

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
unleash unleash to 8.0.1 (exc)
unleash unleash 7.5.2
unleash unleash 7.6.5
unleash unleash 8.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63462 is a Denial of Service (DoS) vulnerability in the Unleash feature management platform affecting versions 8.0.0 and below. It allows unauthenticated attackers to crash the server by sending a POST request with a deeply nested JSON payload (around 10 KB) to OpenAPI-validated endpoints like /edge/validate or /edge/issue-token. The server crashes due to a stack overflow when JSON.stringify attempts to serialize the excessively nested data, causing the Node.js process to terminate immediately.

Detection Guidance

Monitor for crashes in the Unleash server process after receiving POST requests to endpoints like /edge/validate or /edge/issue-token. Check logs for RangeError: Maximum call stack size exceeded errors. Use network traffic analysis to detect unusually large or deeply nested JSON payloads.

Impact Analysis

This vulnerability can cause complete service outages. The server remains offline until manually restarted, and replaying the attack can sustain the downtime. Since no authentication or special settings are required, any unauthenticated user can exploit it. The impact is limited to availability loss; confidentiality and integrity are unaffected.

Compliance Impact

This vulnerability primarily impacts availability, which is a key aspect of compliance for standards like GDPR and HIPAA. A prolonged outage could violate service level agreements or regulatory requirements for data access and system availability. However, the vulnerability does not directly affect confidentiality or integrity of data.

Mitigation Strategies

Upgrade Unleash to versions 7.5.2, 7.6.5, or 8.0.2 or later. If immediate upgrade is not possible, restrict access to OpenAPI-validated endpoints using network-level controls or WAF rules to block large nested JSON payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63462. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart