CVE-2026-77856
HighCVSS 8.2Summary
An allocation of resources without limits vulnerability in ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. The resolve_typed_struct_field/2 function uses String.to_atom/1 for unresolvable names, creating permanent atoms that are never garbage collected, leading to exceeding the limit and crash. This issue affects versions from 0.11.0 before 0.18.0.
Risk Assessment
An attacker could cause a denial of service (DoS) by sending many requests with unique field names, leading to service unavailability.
Recommendation
Update ash_typescript to version 0.18.0 or later. Limit the number of requests and input size.
Other vulnerabilities in ash_typescript
See all- CVE-2026-82733Medium
Generation of error message containing sensitive information vulnerability in ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a route handler returns a non-%Plug.Conn{} value, the unexpected_return/2 function interpolates the full inspect of the value (including passwords, tokens, tenant identifiers) into the error message.
- CVE-2026-82732Medium
Improper input validation vulnerability in ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. The Ash.Type.cast_input/3 function is treated as fully validated, but it does not call Ash.Type.apply_constraints/3, so constraints such as one_of, max_length, min, max, and match are ignored.
- CVE-2026-82731Low
Vulnerability in the ash_typescript library allows an attacker who controls a path-parameter value to redirect a generated client's request, along with attached credentials, to an unintended route or external origin.
- CVE-2026-82730High
An incorrect authorization vulnerability in ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value, and AshTypescript.Rpc.ResultProcessor fails to handle this marker in normalize_primitive/1, leading to serialization of the original value. This issue affects versions from 0.11.0 before 0.18.0.
- CVE-2026-77950Medium
Generation of error message containing sensitive information vulnerability in ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. The apply_error_handler/3 function, when the pattern does not match, raises FunctionClauseError and returns the original error map, including sensitive data.
- CVE-2026-74837High
An allocation of resources without limits vulnerability in ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. The convert_to_field_atom/2 function uses String.to_atom/1 for unresolvable names, creating permanent atoms that are never garbage collected, leading to exceeding the limit and crash. Additionally, field names longer than 255 characters cause an uncaught SystemLimitError. This issue affects versions from 0.1.0 before 0.18.0.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolve_typed_struct_field/2 in lib/ash_typescript/rpc/field_processing/field_selector.ex looks a client-supplied field name up in the typed struct's reverse map and, when it finds no match, falls back to String.to_atom/1. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit. This issue affects ash_typescript: from 0.11.0 before 0.18.0.