Executive brief
ash_typescript is an Elixir library that generates TypeScript types from Ash application schemas. An unauthenticated attacker can send specially crafted requests with arbitrary field names to exhaust the Erlang VM's atom table, causing the entire application server to crash. This results in complete loss of service with no warning to administrators.
Technical details
The vulnerability is a resource exhaustion flaw in the resolve_typed_struct_field/2 function (lib/ash_typescript/rpc/field_processing/field_selector.ex). When processing client-supplied typed struct field names, the code performs a reverse map lookup and falls back to String.to_atom/1 if no match is found, before validating whether the field actually exists. Since atoms in Erlang are never garbage collected, an attacker can trigger creation of unlimited unique atoms by sending requests with many distinct invalid field names. Once the VM's atom table limit is reached, the entire BEAM node aborts. The attack requires network access to the affected endpoint but no authentication. Patches are available in ash_typescript version 0.18.0 and later.
Affected products
- ash-project ash_typescript 0.11.0 to 0.17.x
Timeline
- 2026-09-01: disclosed
- 2026-09-01: advisory: CVE-2026-77856