Description

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating it is non-nil, causing a fatal panic that terminates the entire server when a recovery request is sent to the /api/auth/local/recover endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T11:17:31.137Z",
  "pubdate": "2026-08-10T11:17:31.137Z",
  "executiveSummary": "A NULL pointer dereference vulnerability exists in fastschema through v0.15.1, specifically within the local authentication subsystem.\nThe vulnerability allows an unauthenticated remote attacker to cause a fatal panic and terminate the entire server process by sending a single malicious HTTP request.\nThe flaw resides in the sendOTPEmail function located within pkg/auth/local.go, where an error path remains unchecked and a resulting pointer is dereferenced without prior validation.\nThis introduces a severe availability risk, enabling remote denial-of-service (DoS) conditions against vulnerable deployments without requiring any user interaction, authentication, or elevated privileges.\nBecause the panic terminates the server process directly, continuous automated exploitation can maintain a persistent service outage.",
  "technicalDetails": "The root cause of the vulnerability is the absence of error checking and subsequent validation of a pointer returned from an operation inside the sendOTPEmail function.\nThe vulnerable component is identified as the sendOTPEmail function within the pkg/auth/local.go file of the fastschema codebase, specifically affecting versions up to v0.15.1.\nWhen a user initiates a recovery request via the unauthenticated HTTP endpoint at /api/auth/local/recover, the application executes the vulnerable code path.\nInstead of verifying whether the pointer obtained from the operation is non-nil, the function attempts to dereference it directly.\nThis unchecked dereference triggers a runtime panic in the Go runtime environment.\nBecause Go panics originating from unhandled runtime errors generally terminate the application process when not recovered, the entire server instance crashes immediately upon receiving the malicious request.\nThe attack vector is network-based, utilizing standard HTTP/HTTPS protocols over the web interface exposed by fastschema.\nThe exploitation requirements are minimal: the attacker requires network connectivity to the target server's /api/auth/local/recover endpoint and does not need to authenticate, possess valid credentials, or hold any administrative privileges.\nThe post-exploitation impact is strictly limited to denial of service through process termination, as remote code execution or unauthorized data access is not facilitated by this specific memory dereference vector."
}