Executive brief
The New API application provides payment webhook endpoints for Stripe, Creem, and Waffo that process incoming payment notifications. An unauthenticated attacker can send oversized HTTP requests to these public endpoints, causing the application to read and log the full request body before validating the webhook signature. This forces excessive memory consumption and disk usage from logs, potentially crashing the application or filling storage, denying service to legitimate users.
Technical details
The vulnerability is a resource exhaustion issue (CWE-400, CWE-770) in the payment webhook handlers for Stripe, Creem, and Waffo. The root cause is that the application reads and logs the complete HTTP request body at the unauthenticated handler level before performing webhook signature validation. An attacker with network access to the public endpoints `/api/stripe/webhook`, `/api/creem/webhook`, or `/api/waffo/webhook` can send arbitrarily large POST requests without authentication. The application will consume memory buffering the entire body and generate voluminous log entries before rejecting the request during signature validation. This causes availability impact through memory exhaustion (container OOM kills) and disk exhaustion from log growth. The fix, released in v1.0.0-rc.11, adds middleware-level request body limits (default 512 KiB) to all unauthenticated POST routes, enforced before body reading. No signature forgery is possible since signature validation logic remains intact.
Affected products
- QuantumNous new-api < 1.0.0-rc.11
Timeline
- 2026-08-17: disclosed: GitHub Advisory GHSA-v828-m3pf-vq9q published
- 2026-08-17: patched: Fix released in v1.0.0-rc.11