CVE-2026-46714: Misskey DOS Vulnerability

CVE-2026-46714 Overview

CVE-2026-46714 is a denial-of-service vulnerability in Misskey, an open source federated social media platform. Versions 8.63.0 and later, prior to 2026.5.4, contain a flaw that causes the Misskey web client to slow down or crash when it applies a malformed theme. The issue is classified under CWE-674 (Uncontrolled Recursion) and requires user interaction to trigger. The Misskey maintainers fixed the vulnerability in version 2026.5.4.

Critical Impact
A malformed theme can cause the Misskey web client to hang or crash, disrupting availability of the client interface for affected users.

Affected Products

Misskey versions 8.63.0 through releases prior to 2026.5.4
Misskey web client component
Self-hosted and federated Misskey instances running affected versions

Discovery Timeline

2026-08-03 - CVE-2026-46714 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-46714

Vulnerability Analysis

The vulnerability resides in the Misskey web client's theme parsing and application logic. When the client processes a malformed theme, it enters a state of excessive resource consumption that degrades performance or terminates the client session. The weakness is tracked as CWE-674: Uncontrolled Recursion, indicating that theme handling can recurse without a bounded stopping condition.

The impact is limited to availability of the web client. The vulnerability does not expose confidentiality or integrity of user data on the server. However, disrupted client sessions can prevent users from interacting with their Misskey instance until the malicious theme is removed or replaced.

Root Cause

The root cause is insufficient validation of theme input structures before they are processed by the client. Themes in Misskey are user-supplied data that the client parses and applies at runtime. Without bounded parsing logic, a specially crafted theme structure can trigger runaway recursion or excessive computation in the browser context.

Attack Vector

An attacker crafts a malformed theme and delivers it to a target through federation, direct sharing, or a public theme repository. The target must apply the theme, satisfying the user interaction requirement. Once applied, the client attempts to parse the theme and consumes CPU or memory resources until the browser tab becomes unresponsive or crashes. The attack does not require authentication on the victim's instance and can be delivered across federated servers.

No verified proof-of-concept code is publicly available. For further technical detail, consult the GitHub Security Advisory GHSA-wmhf-m93m-rgmj.

Detection Methods for CVE-2026-46714

Indicators of Compromise

Repeated reports from users of the Misskey web client freezing or crashing after applying a theme.
Browser tabs consuming abnormally high CPU or memory when rendering the Misskey client interface.
Theme payloads containing deeply nested structures or references that trigger recursion during parsing.

Detection Strategies

Inventory all Misskey deployments and identify instances running versions from 8.63.0 up to but not including 2026.5.4.
Monitor client-side error telemetry and browser crash reports associated with the Misskey web application.
Review theme submissions and shared theme URLs for unusually large or structurally anomalous payloads.

Monitoring Recommendations

Track federated activity involving theme sharing across untrusted instances.
Alert on repeated browser crash reports from users of the same Misskey instance.
Watch the Misskey release feed for further security-related patches.

How to Mitigate CVE-2026-46714

Immediate Actions Required

Upgrade all Misskey instances to version 2026.5.4 or later as documented in the GitHub Release 2026.5.4.
Notify users to avoid applying themes from untrusted sources until the upgrade completes.
Remove any suspect themes from user profiles and instance-level theme repositories.

Patch Information

The Misskey project fixed CVE-2026-46714 in version 2026.5.4. Administrators should apply the update following standard Misskey upgrade procedures. Full patch details are available in the GitHub Security Advisory GHSA-wmhf-m93m-rgmj.

Workarounds

Instruct users not to apply themes received from federated or untrusted sources until the instance is patched.
Reset the active theme to a known-good default if the client becomes unresponsive after theme application.
Restrict theme sharing features at the instance level where operationally feasible.

bash

# Configuration example: upgrade a self-hosted Misskey deployment
git fetch --tags
git checkout 2026.5.4
pnpm install
pnpm run build
pnpm run migrate
systemctl restart misskey