Description

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-21T19:17:31.927Z",
  "pubdate": "2026-08-21T19:17:31.927Z",
  "executiveSummary": "Unleash prior to versions 7.5.2, 7.6.5, and 8.0.2 is vulnerable to a stack exhaustion vulnerability resulting in a Denial of Service (DoS) condition.\nThe vulnerability resides in the shared OpenAPI validation error handling mechanism located in src/lib/error/bad-data-error.ts, specifically within the genericErrorMessage and fromOpenApiValidationErrors functions, which process raw request values derived from lodash.get using JSON.stringify without guard rails against deep object nesting.\nAn unauthenticated attacker can exploit this flaw by submitting a maliciously crafted JSON payload nested thousands of levels deep to OpenAPI-validated endpoints such as POST /edge/validate or POST /edge/issue-token.\nThis payload triggers a RangeError due to the maximum call stack size being exceeded within the openAPIValidationMiddleware.\nBecause the Node.js process lacks an uncaughtException handler to recover from this exception, the service crashes completely.\nBy continuously replaying the crafted request, an attacker can sustain a total service outage, severely impacting availability for dependent feature management systems.",
  "technicalDetails": "The root cause of the vulnerability is the unsafe handling of deeply nested JSON structures during OpenAPI validation error processing in Unleash.\nThe vulnerable component is located in the file src/lib/error/bad-data-error.ts.\nSpecifically, the functions genericErrorMessage and fromOpenApiValidationErrors utilize lodash.get to retrieve raw request values and pass them directly to JSON.stringify without implementing recursion depth limits or safeguards against circular and excessively deep structures.\nAffected software versions include all versions of Unleash prior to 7.5.2, 7.6.5, and 8.0.2.\nThe attack vector is network-exposed, requiring no authentication or privileges, as the vulnerable endpoints are accessible to unauthenticated users.\nThe exploitation flow proceeds step-by-step as follows: First, an unauthenticated attacker crafts a malicious JSON payload approximately 10 KB in size that is nested thousands of levels deep.\nSecond, the attacker transmits this payload to an OpenAPI-validated endpoint, such as POST /edge/validate or POST /edge/issue-token.\nThird, the openAPIValidationMiddleware intercepts the request, and upon encountering validation errors, triggers the error serialization logic in src/lib/error/bad-data-error.ts.\nFourth, functions like genericErrorMessage and fromOpenApiValidationErrors attempt to process the deeply nested raw request values using JSON.stringify.\nFifth, the recursive traversal of the deeply nested object exhausts the JavaScript call stack, throwing a RangeError with the message Maximum call stack size exceeded.\nFinally, because the Node.js runtime does not catch this specific fatal exception, the entire Node process terminates immediately.\nRepeatedly sending this payload results in sustained application downtime and complete operational disruption."
}