# EvoMap evolver unbounded request body in /asset/submit proxy

Source: https://junglewise.ai/threats/evomap-evolver-unbounded-request-body-in-asset-submit-proxy-73c2c485  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-05-05

@evomap/evolver is a JavaScript proxy daemon used to manage asset submissions and messaging. An unauthenticated local attacker can send arbitrarily large HTTP POST requests to the /asset/submit endpoint, causing the daemon to store unlimited data to disk. This exhausts available disk space persistently, even after daemon restarts, leading to application unavailability and potential data loss across the system.

Technologies: [EvoMap Evolver](https://junglewise.ai/threats/technologies/evolver), [@evomap/evolver (npm)](https://junglewise.ai/threats/technologies/evomap-evolver). Vendors: [EvoMap](https://junglewise.ai/threats/vendors/evomap), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 5 May 2026.

**Which products and versions are affected?** EvoMap Evolver <= 1.70.0-beta.4; @evomap/evolver (npm) SEMVER:introduced=0,fixed=1.70.0-beta.5.

**Is there a fix for This vulnerability?** Yes. @evomap/evolver (npm): upgrade to 1.70.0-beta.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access, in a hosted service.

**Am I affected?** Check whether you run EvoMap Evolver or @evomap/evolver (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @evomap/evolver (npm): upgrade to 1.70.0-beta.5 or later

  ```sh
  npm install @evomap/evolver@1.70.0-beta.5
  ```


## Technical details

The vulnerability is an unbounded denial-of-service (DoS) via unvalidated request body size in the HTTP proxy's /asset/submit and /mailbox/send routes. The parseBody() function in src/proxy/server/http.js accumulates all incoming request chunks without checking Content-Length or enforcing a cumulative-byte limit. The POST handler forwards the full body payload to store.send(), which persists it verbatim as a JSONL line in messages.jsonl via synchronous fs.appendFileSync(). An unauthenticated local process (another system user, container neighbor, or malicious npm postinstall script) can repeatedly POST multi-megabyte bodies to rapidly fill the disk. On daemon restart, _rebuildIndex() calls fs.readFileSync() synchronously to read the entire messages.jsonl file, causing out-of-memory crashes if the file is multi-gigabytes. The daemon is bound to 127.0.0.1 only, but local access is achievable in multi-tenant dev environments, shared containers, and during npm package installation. Patched in version 1.70.0-beta.5.

## Affected products

- EvoMap evolver <= 1.70.0-beta.4

## Timeline

- 2026-05-05: disclosed
- 2026-05-05: patched: Fixed in version 1.70.0-beta.5

## References

- [https://github.com/EvoMap/evolver/security/advisories/GHSA-7xp7-m392-h92c](https://github.com/EvoMap/evolver/security/advisories/GHSA-7xp7-m392-h92c)
- [https://github.com/EvoMap/evolver](https://github.com/EvoMap/evolver)

## Related threats

- [EvoMap evolver validator sandbox RCE via npm/npx lifecycle scripts](https://junglewise.ai/threats/evomap-evolver-validator-sandbox-rce-via-npm-npx-lifecycle-scripts-a6b4eae8)
- [EvoMap evolver path traversal in fetch command allows RCE](https://junglewise.ai/threats/evomap-evolver-path-traversal-in-fetch-command-allows-rce-96421234)
- [Evolver prototype pollution in mailbox store via Object.assign()](https://junglewise.ai/threats/cve-2026-42077-evomap-evolver-prototype-pollution-in-mailbox-store)
- [Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM()](https://junglewise.ai/threats/cve-2026-42076-evomap-evolver-command-injection-via-execsync-in-extractllm)
- [EvoMap Evolver path traversal in fetch command via --out flag](https://junglewise.ai/threats/cve-2026-42075-evomap-evolver-path-traversal-in-fetch-command-via-out-flag)