Listen to this Post
The vulnerability exists in the Unleash OSS server’s request-validation error handling, specifically within the shared error formatting path. An unauthenticated attacker can send a POST request to any OpenAPI-validated endpoint, including the publicly accessible /edge/validate and /edge/issue-token. When the request body fails validation, the server constructs an error message that includes the offending value. To display this, the code calls JSON.stringify on the raw property extracted directly from the request using lodash.get. By providing a deeply nested array or object, such as a depth of 5000, the serialization causes V8 to recurse beyond its call-stack limit, throwing a synchronous RangeError. This error occurs inside the Express error-handling middleware, which lacks any try-catch protection around the stringify call. The controller’s own try-catch wraps only the route handler, not the middleware, so the exception propagates unhandled. Node’s default behavior for uncaught synchronous exceptions is to terminate the process with exit code 1. The application registers a listener for unhandledRejection but no handler for uncaughtException, ensuring the crash is fatal. The body-parser imposes a 100 KB size limit, but the crashing payload at depth 5000 is merely 10–13 KB, bypassing this restriction. There is also no JSON nesting-depth limit enforced during parsing. The same vulnerable pattern appears in multiple error functions, making the issue widespread. A nesting level of 4000–4500 is already sufficient to trigger the crash reliably. The attack requires no authentication, session, CSRF token, or any special configuration. Once the process exits, the server remains down unless an external orchestration restarts it; default Docker setups do not auto-restart. An attacker can replay the single 10 KB request to sustain a denial-of-service indefinitely. Live verification confirms that a single POST to /edge/validate drops the /health endpoint from 200 to 000 immediately. The crash is route-independent, affecting every endpoint that uses OpenAPI validation. This critical flaw jeopardizes the availability of feature-flag evaluation for all dependent services.
DailyCVE Form:
Platform: Unleash OSS
Version: 8.0.0 main
Vulnerability: Deep JSON DoS
Severity: Critical
date: 2026-08-22
Prediction: Upcoming patch release
What Undercode Say:
Generate crashing payload (depth 5000, ~10KB)
python3 -c 'd=5000; print("{\"tokens\":[" + "["d + "]"d + "]}")' > payload.json
Send to anonymous endpoint
curl -s -o /dev/null -w '%{http_code}\n' -X POST http://localhost:4242/edge/validate \
-H 'Content-Type: application/json' --data-binary @payload.json
Verify server is down (returns 000)
curl -s -o /dev/null -w '%{http_code}\n' http://localhost:4242/health
Check container status (exited with no restart)
docker inspect <container> --format '{{.State.Status}} restarts={{.RestartCount}}'
Exploit: (Educational Purposes!)
Send a single HTTP POST request to any OpenAPI-validated route (e.g., /edge/validate or /edge/issue-token) with a JSON body containing an array or object nested 5000 levels deep. The body must be a valid JSON but deeply nested, e.g., {“tokens”: [[[…]]]}. The server attempts to JSON.stringify the offending nested value, exceeds the call stack, crashes the Node process, and exits. Replay the same request to maintain the outage.
Protection:
Upgrade to a patched version once available. As a temporary mitigation, implement a custom middleware to limit JSON nesting depth using a parser like `json-parse-better-errors` with a depth limit, or add a try-catch around the JSON.stringify call in bad-data-error.ts. Alternatively, register an `uncaughtException` handler that logs and performs a graceful restart, though this does not fix the root cause. Disable anonymous endpoints if not required, or deploy a reverse proxy that rejects requests with excessive nesting.
Impact:
A remote, unauthenticated attacker can crash the entire Unleash server with a single 10 KB request, causing a complete denial of service. Since no restart policy is set by default, the outage persists until manual intervention. All applications depending on the server for feature-flag evaluation will experience cascading failures, and the attack can be sustained with minimal bandwidth, making it a highly critical availability risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
