Executive brief
ash_typescript is a TypeScript integration library for the Ash framework used in Elixir applications. An unauthenticated attacker can crash the application by sending specially crafted RPC requests with arbitrary field names, exhausting the Erlang BEAM VM's atom table which is never garbage collected. This results in complete service unavailability.
Technical details
The vulnerability is an allocation of resources without limits or throttling (CWE-770) in the RPC field processing logic. The AshTypescript.FieldFormatter.convert_to_field_atom/2 function converts client-supplied field names to atoms using String.to_atom/1 without validation, allowlist, or rate limiting. Since atoms in the BEAM VM are never garbage collected, each unique field name consumes permanent atom table space. An unauthenticated attacker can send repeated RPC requests with distinct field names to exhaust the atom table and abort the entire node. Additionally, field names exceeding 255 characters trigger an uncaught SystemLimitError. The attack vector is network-based and requires no authentication or user interaction.
Affected products
- ash-project ash_typescript 0.1.0 through 0.17.x (fixed in 0.18.0)
Timeline
- 2026-09-01: disclosed: CVE-2026-74837 published
- 2026-09-01: patched: Fix available in version 0.18.0