Description

A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T20:17:42.563Z",
  "pubdate": "2026-09-02T20:17:42.563Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists in rowboatlabs rowboat up to version 0.9.1 within the Composio Webhook Endpoint.\nThe vulnerability resides in the request.text and req.json functions located in apps/rowboat/app/api/composio/webhook/route.ts.\nThis flaw allows a remote, unauthenticated attacker to trigger a crash or resource exhaustion, effectively rendering the webhook service unavailable.\nThe risk is significant due to the potential for service disruption and the public availability of exploit details.\nRowboatlabs addressed this by removing the legacy Next.js application in version 0.9.2, as a direct patch was deemed impractical for this specific component.",
  "technicalDetails": "The vulnerability originates from improper request body handling within the Composio Webhook Endpoint of the rowboat application. Specifically, the functions request.text and req.json in apps/rowboat/app/api/composio/webhook/route.ts fail to adequately validate or limit incoming payload sizes and structures before processing.\nIn a Next.js environment, these functions are responsible for parsing incoming HTTP request bodies. When a malicious payload is submitted, the internal parsing logic experiences a failure—likely due to memory exhaustion or unhandled exceptions during the serialization of large or malformed JSON data—which leads to the termination of the request handler process or the entire server instance.\nThe attack flow involves a remote threat actor dispatching a crafted HTTP request directly to the public-facing webhook endpoint. Because the endpoint does not require pre-authentication for the initial handshake and payload parsing, the attack vector is exposed to any user capable of reaching the service via the network. By delivering a payload that triggers the underlying flaw in the parsing functions, the attacker forces the application into an unstable state.\nThe post-exploitation impact is immediate service denial. Since the parsing occurs early in the request lifecycle, the vulnerability enables an attacker to degrade or halt the system functionality consistently. The lack of robust input validation and size constraints on the request stream allows this disruption to occur with minimal effort from the attacker side.\nThe affected versions include all releases of rowboat up to and including 0.9.1. It is critical to note that the remediation strategy implemented in version 0.9.2 involved the complete removal of the legacy Next.js application rather than a functional patch. This architectural change eliminates the vulnerable code path entirely, serving as the primary method to mitigate the risk associated with this specific webhook implementation."
}