CVE-2026-84856

MediumCVSS 5.3

Published: 02/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.70%

51th percentile - higher than 51% of all known CVEs

Summary

A denial of service vulnerability was found in rowboatlabs rowboat up to version 0.9.1, affecting the request.text/req.json function in the file apps/rowboat/app/api/composio/webhook/route.ts of the Composio Webhook Endpoint component. The attack can be launched remotely. Version 0.9.2 resolves the issue but removes the legacy Next.js app without security controls.

Risk Assessment

A remote attack can cause service unavailability, potentially impacting application continuity. Upgrading to 0.9.2 fixes the issue but requires attention as it removes the legacy app.

Recommendation

Upgrade rowboat to version 0.9.2 or later. Before upgrading, verify that removing the legacy Next.js app does not affect functionality.

Other vulnerabilities in rowboat

CVE-2026-86122Medium
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network topology.

Original NVD description (English source)

A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS