Executive brief
Unleash is a feature-flag management server used to control application behavior in production. An unauthenticated attacker can crash the entire server with a single 10 KB POST request containing deeply-nested JSON sent to any validation endpoint. The server does not recover automatically, and repeated requests can sustain an indefinite outage without a restart policy.
Technical details
The vulnerability is an uncontrolled recursion flaw (CWE-674) in the OpenAPI request validation error path. When validation fails, the error formatter in src/lib/error/bad-data-error.ts calls JSON.stringify(propertyValue) directly on request-body data extracted via lodash.get, with no recursion limit or try/catch wrapper. A JSON object or array nested 4000–5000 levels deep causes JSON.stringify to exceed V8's call stack, throwing RangeError: Maximum call stack size exceeded synchronously. The synchronous throw propagates through the Express error middleware openAPIValidationMiddleware in src/lib/routes/controller.ts, which has no error handler. The Node.js process registers only unhandledRejection, not uncaughtException, so the synchronous error terminates the process with exit(1). The vulnerability is route-independent, affecting all OpenAPI-validated endpoints including the anonymous POST /edge/validate and POST /edge/issue-token. Patched versions are 7.5.2, 7.6.5, and 8.0.2.
Affected products
- Unleash unleash-server < 7.5.2, >= 7.6.0 and < 7.6.5, >= 8.0.0 and < 8.0.2
Timeline
- 2026-08-21: disclosed: Advisory published on GitHub Advisory Database
- 2026-07-01: patched: Patches released as v7.5.2, v7.6.5, and v8.0.2