# CVE-2023-50709: Cube API denial of service

Source: https://junglewise.ai/threats/cve-2023-50709-cube-api-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-12-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-50709 · Severity: low · CVSS 3.1 · Published 2023-12-13

Cube is an open-source analytics platform that provides an API gateway for querying data. A flaw in the API gateway allows attackers with basic authentication credentials to crash the entire service by sending a specially crafted request, disrupting availability for all users and causing operational downtime.

Technologies: [@cubejs-backend/api-gateway (npm)](https://junglewise.ai/threats/technologies/cubejs-backend-api-gateway). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-50709 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-50709 being exploited in the wild.

**How severe is CVE-2023-50709?** Low severity, with a CVSS score of 3.1, published 13 December 2023.

**Which products and versions are affected?** @cubejs-backend/api-gateway (npm) SEMVER:introduced=0,fixed=0.34.34.

**Is there a fix for CVE-2023-50709?** Yes. @cubejs-backend/api-gateway (npm): upgrade to 0.34.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-50709 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-50709?** Check whether you run @cubejs-backend/api-gateway (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @cubejs-backend/api-gateway (npm): upgrade to 0.34.34 or later

  ```sh
  npm install @cubejs-backend/api-gateway@0.34.34
  ```


## Technical details

A denial of service vulnerability (CWE-20: improper input validation) exists in Cube's API gateway endpoint that allows authenticated attackers to crash the service with a malicious request. The vulnerability requires low-privilege authentication (PR:L) and can be triggered over the network without user interaction. A successful exploit causes complete service unavailability affecting all users. The issue has been patched in version 0.34.34 and users are advised to upgrade immediately, with no workarounds available for older versions.

## Affected products

- Cube API Gateway < 0.34.34

## Identifiers

- CVE-2023-50709
- GHSA-9759-3276-g2pm

## Timeline

- 2023-12-13: disclosed: Vulnerability published; reported by y0d3n in community
- 2023-12-13: patched: Fix released in v0.34.34

## References

- [https://github.com/cube-js/cube/security/advisories/GHSA-9759-3276-g2pm](https://github.com/cube-js/cube/security/advisories/GHSA-9759-3276-g2pm)

## Related threats

- [Cube.js API Gateway row-level security bypass](https://junglewise.ai/threats/cve-2022-23510-cube-js-api-gateway-row-level-security-bypass)
- [Cube.js API Gateway authentication middleware bypass in production](https://junglewise.ai/threats/cube-js-api-gateway-authentication-middleware-bypass-in-production-5024063d)