# CVE-2026-74837: ash-project ash_typescript denial of service via resource exhaustion

Source: https://junglewise.ai/threats/cve-2026-74837-ash-project-ash-typescript-denial-of-service-via-resource  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-74837 · Severity: info · CVSS 7.5 · Published 2026-09-01

ash_typescript is a TypeScript integration library for the Ash framework used in Elixir applications. An unauthenticated attacker can crash the application by sending specially crafted RPC requests with arbitrary field names, exhausting the Erlang BEAM VM's atom table which is never garbage collected. This results in complete service unavailability.

Technologies: [Ash-Project Ash Typescript](https://junglewise.ai/threats/technologies/ash-typescript). Vendors: [Ash-Project](https://junglewise.ai/threats/vendors/ash-project).

## Quick answers

**Is CVE-2026-74837 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74837 being exploited in the wild.

**How severe is CVE-2026-74837?** Informational severity, with a CVSS score of 7.5, published 1 September 2026.

**Which products and versions are affected?** Ash-Project Ash Typescript 0.1.0 through 0.17.x (fixed in 0.18.0).

**Is there a fix for CVE-2026-74837?** A patch was published on 2026-09-01: Fix available in version 0.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74837 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-74837?** Check whether you run Ash-Project Ash Typescript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an allocation of resources without limits or throttling (CWE-770) in the RPC field processing logic. The AshTypescript.FieldFormatter.convert_to_field_atom/2 function converts client-supplied field names to atoms using String.to_atom/1 without validation, allowlist, or rate limiting. Since atoms in the BEAM VM are never garbage collected, each unique field name consumes permanent atom table space. An unauthenticated attacker can send repeated RPC requests with distinct field names to exhaust the atom table and abort the entire node. Additionally, field names exceeding 255 characters trigger an uncaught SystemLimitError. The attack vector is network-based and requires no authentication or user interaction.

## Affected products

- ash-project ash_typescript 0.1.0 through 0.17.x (fixed in 0.18.0)

## Timeline

- 2026-09-01: disclosed: CVE-2026-74837 published
- 2026-09-01: patched: Fix available in version 0.18.0

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [Ash TypeScript error message information disclosure](https://junglewise.ai/threats/cve-2026-105283-generation-of-error-message-containing-sensitive-information)
- [ash-project ash_typescript information disclosure in error responses](https://junglewise.ai/threats/cve-2026-82733-ash-project-ash-typescript-information-disclosure-in-error)
- [ash-project ash_typescript input validation bypass in TypedController](https://junglewise.ai/threats/cve-2026-82732-ash-project-ash-typescript-input-validation-bypass-in)
- [ash-project ash_typescript open redirect in typed controller routing](https://junglewise.ai/threats/cve-2026-82731-ash-project-ash-typescript-open-redirect-in-typed-controller)
- [ash-project ash_typescript unauthorized attribute disclosure in RPC](https://junglewise.ai/threats/cve-2026-82730-ash-project-ash-typescript-unauthorized-attribute-disclosure-in)