CVE-2026-63462: Unleash Feature Platform DoS Vulnerability

CVE-2026-63462 Overview

Unleash is an open-source feature management platform used by development teams to control feature rollouts. A denial-of-service vulnerability affects Unleash versions prior to 7.5.2, 7.6.5, and 8.0.2. The shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes raw request values from lodash.get to JSON.stringify without guarding against stack exhaustion. An unauthenticated attacker can crash the Node process by submitting deeply nested JSON to any OpenAPI-validated endpoint. Replaying the request sustains a complete service outage. The issue is tracked as [CWE-674: Uncontrolled Recursion].

Critical Impact
Unauthenticated attackers can trigger a complete Unleash service outage using a single 10 KB deeply nested JSON payload sent to endpoints such as POST /edge/validate or POST /edge/issue-token.

Affected Products

Unleash versions prior to 7.5.2 (7.5.x branch)
Unleash versions prior to 7.6.5 (7.6.x branch)
Unleash versions prior to 8.0.2 (8.0.x branch)

Discovery Timeline

2026-08-21 - CVE-2026-63462 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-63462

Vulnerability Analysis

The vulnerability resides in Unleash's OpenAPI validation error-handling logic. When request validation fails, the middleware openAPIValidationMiddleware invokes genericErrorMessage and fromOpenApiValidationErrors in src/lib/error/bad-data-error.ts. Both functions retrieve the offending value using lodash.get and pass it directly to JSON.stringify. Node's JSON.stringify implementation recurses through nested object structures, and a payload nested thousands of levels deep exceeds the V8 call stack limit. The resulting RangeError: Maximum call stack size exceeded propagates as an uncaught exception. Because Unleash does not register an uncaughtException handler that safely recovers, the Node process terminates.

Root Cause

The root cause is uncontrolled recursion [CWE-674] during error serialization. The error path assumes validation failure inputs are shallow and well-formed, but it operates on attacker-controlled JSON that has already been parsed. No depth guard, size limit, or try/catch wraps the JSON.stringify call, so any recursion failure crashes the process instead of returning a 400 response.

Attack Vector

An unauthenticated remote attacker sends a JSON body of roughly 10 KB nested thousands of levels deep to any OpenAPI-validated endpoint, including POST /edge/validate and POST /edge/issue-token. The request triggers validation failure, and the failure handler crashes the Node runtime. Repeating the request across process restarts produces a sustained outage.

typescript

// Patch from src/lib/error/bad-data-error.ts wrapping JSON.stringify
     path?: string;
 };
 
+const safeStringify = (value: unknown): string => {
+    try {
+        return JSON.stringify(value);
+    } catch {
+        return '[value too large or deeply nested to display]';
+    }
+};
+
 class BadDataError extends UnleashError {
     statusCode = 400;

Source: GitHub Commit b0e4da6

The patch introduces a safeStringify wrapper that catches serialization failures and returns a placeholder message, preventing the uncaught RangeError from terminating the process.

Detection Methods for CVE-2026-63462

Indicators of Compromise

Node process crashes accompanied by RangeError: Maximum call stack size exceeded referencing openAPIValidationMiddleware, genericErrorMessage, or fromOpenApiValidationErrors.
Repeated unauthenticated POST requests to /edge/validate, /edge/issue-token, or other OpenAPI-validated endpoints with unusually deep JSON bodies near 10 KB.
Container or supervisor logs showing rapid Unleash restart loops correlated with the same source IP.

Detection Strategies

Alert on Node.js uncaughtException events from the Unleash process, particularly stack traces referencing the OpenAPI validation middleware.
Inspect ingress or reverse proxy logs for JSON request bodies with excessive nesting depth by parsing and measuring maximum object depth pre-forwarding.
Baseline HTTP 5xx and connection-reset rates on Unleash endpoints and alert on statistically significant deviations.

Monitoring Recommendations

Enable process supervision metrics (systemd, Kubernetes liveness probes) and forward restart events to your SIEM for correlation.
Log request body sizes and rejection reasons at the API gateway to identify probing behavior against /edge/* routes.
Track authentication-free endpoints separately and rate-limit by source IP.

How to Mitigate CVE-2026-63462

Immediate Actions Required

Upgrade Unleash to 7.5.2, 7.6.5, or 8.0.2 depending on your current release branch.
Place Unleash behind a reverse proxy or WAF that rejects JSON bodies exceeding a bounded nesting depth.
Restrict network exposure of /edge/validate and /edge/issue-token to trusted client networks where feasible.

Patch Information

The fix is available in the following releases: GitHub Release v7.5.2, GitHub Release v7.6.5, and GitHub Release v8.0.2. The primary code change is GitHub Commit b0e4da6, which wraps JSON.stringify in a safeStringify helper. Additional hardening for addon serialization and URL validation appears in GitHub Commit d45f99d and GitHub Commit d862562. Full details are in GitHub Security Advisory GHSA-r5pq-6chh-j3xp.

Workarounds

Configure your API gateway or reverse proxy to enforce a maximum JSON body size well below 10 KB for Edge endpoints and reject payloads exceeding a nesting depth of, for example, 32 levels.
Add a process-level uncaughtException handler that logs and gracefully restarts, reducing outage duration while patches are applied.
Apply per-source-IP rate limits on unauthenticated Edge endpoints to slow replay-driven outages.

bash

# Example NGINX snippet limiting request body size for Unleash Edge endpoints
location ~ ^/edge/(validate|issue-token)$ {
    client_max_body_size 8k;
    limit_req zone=unleash_edge burst=5 nodelay;
    proxy_pass http://unleash_upstream;
}