Executive brief
Rowboat is a development framework that includes a Composio Webhook Endpoint component. A vulnerability in how this endpoint handles incoming request data allows attackers to remotely cause the application to become unresponsive or crash. This could interrupt service availability for applications relying on this webhook functionality without requiring any authentication.
Technical details
The vulnerability is a denial of service flaw in the Composio Webhook Endpoint (apps/rowboat/app/api/composio/webhook/route.ts) affecting versions up to 0.9.1. The issue stems from improper handling of the request body in the request.text/req.json function parsing, allowing an attacker to submit a malicious or oversized request payload that exhausts resources and causes service disruption. The attack is network-reachable and requires no authentication or user interaction. Remediation involves upgrading to version 0.9.2 or later; however, note that version 0.9.2 removed the legacy Next.js app entirely rather than patching the vulnerability.
Affected products
- Rowboat Labs Rowboat up to 0.9.1
Timeline
- 2026-09-02: disclosed
- 2026-09-01: patched