Is CVE-2026-74837 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74837 being exploited in the wild.

How severe is CVE-2026-74837?

Informational severity, with a CVSS score of 7.5, published 1 September 2026.

Which products and versions are affected?

Ash-Project Ash Typescript 0.1.0 through 0.17.x (fixed in 0.18.0).

Is there a fix for CVE-2026-74837?

A patch was published on 2026-09-01: Fix available in version 0.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74837 attacked?

It is attacked over the network.

Am I affected by CVE-2026-74837?

Check whether you run Ash-Project Ash Typescript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74837: ash-project ash_typescript denial of service via resource exhaustion

CVE-2026-74837 · Severity: info · CVSS 7.5 · Published 2026-09-01

ash_typescript is a TypeScript integration library for the Ash framework used in Elixir applications. An unauthenticated attacker can crash the application by sending specially crafted RPC requests with arbitrary field names, exhausting the Erlang BEAM VM's atom table which is never garbage collected. This results in complete service unavailability.

Technologies: Ash-Project Ash Typescript. Vendors: Ash-Project.

Quick answers

Is CVE-2026-74837 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74837 being exploited in the wild.
How severe is CVE-2026-74837?: Informational severity, with a CVSS score of 7.5, published 1 September 2026.
Which products and versions are affected?: Ash-Project Ash Typescript 0.1.0 through 0.17.x (fixed in 0.18.0).
Is there a fix for CVE-2026-74837?: A patch was published on 2026-09-01: Fix available in version 0.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74837 attacked?: It is attacked over the network.
Am I affected by CVE-2026-74837?: Check whether you run Ash-Project Ash Typescript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an allocation of resources without limits or throttling (CWE-770) in the RPC field processing logic. The AshTypescript.FieldFormatter.convert_to_field_atom/2 function converts client-supplied field names to atoms using String.to_atom/1 without validation, allowlist, or rate limiting. Since atoms in the BEAM VM are never garbage collected, each unique field name consumes permanent atom table space. An unauthenticated attacker can send repeated RPC requests with distinct field names to exhaust the atom table and abort the entire node. Additionally, field names exceeding 255 characters trigger an uncaught SystemLimitError. The attack vector is network-based and requires no authentication or user interaction.

Affected products

ash-project ash_typescript 0.1.0 through 0.17.x (fixed in 0.18.0)

Timeline

2026-09-01: disclosed: CVE-2026-74837 published
2026-09-01: patched: Fix available in version 0.18.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.