Description

A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. Impacted is the function saveTodos of the file src/index.js of the component API Todo Endpoint. Such manipulation of the argument event.body leads to resource consumption. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-13T20:16:51.660Z",
  "pubdate": "2026-09-13T20:16:51.660Z",
  "executiveSummary": "A resource consumption vulnerability exists in the saveTodos function within the serverless-todo application (versions 1.0.3 and 2.0.0).\nThe vulnerability originates from improper validation of the event.body argument within the API Todo Endpoint component.\nThis flaw allows remote, unauthenticated attackers to trigger excessive resource consumption on the underlying serverless infrastructure.\nBy manipulating input data sent to the vulnerable endpoint, an attacker can force the function to process malicious payloads that lead to service degradation or increased operational costs.\nAs the project maintainers have not addressed this issue despite early notification, and public exploits are available, this vulnerability poses a significant operational and security risk to any environment deploying this software.",
  "technicalDetails": "The vulnerability is located in the src/index.js file within the saveTodos function, which acts as an API Todo Endpoint for the serverless-todo project.\nThe root cause of the vulnerability is the lack of input sanitization or validation on the event.body object provided by the API request.\nBecause the function fails to adequately constrain the structure or size of the input data before processing, it becomes susceptible to resource consumption attacks.\nThe attack flow begins with a remote actor crafting a malicious HTTP request directed at the API endpoint responsible for saving todo items.\nThe attacker sends a specially crafted event.body payload designed to consume disproportionate amounts of CPU, memory, or execution time during the parsing or serialization process.\nOnce the payload reaches the serverless execution environment, the unvalidated data is processed by the saveTodos function.\nThe lack of bounds checking on the input allows the attacker to force the serverless function to perform expensive operations, potentially leading to function timeouts or hitting concurrency limits.\nBecause this is a serverless application, the impact extends beyond simple denial-of-service; it can lead to massive scaling of invocations, resulting in significant financial impact due to increased cloud service billing and potential exhaustion of execution quotas.\nNo authentication or specific privileges are required to exploit this vulnerability, as the endpoint is exposed remotely.\nPublicly available exploit code demonstrates that an attacker can easily replicate this attack vector, necessitating urgent remediation for any affected deployments."
}