CVE-2026-72582: fastschema NULL Pointer DoS Vulnerability

CVE-2026-72582 Overview

CVE-2026-72582 is a NULL pointer dereference vulnerability in FastSchema through version v0.15.1. The flaw resides in the sendOTPEmail function within pkg/auth/local.go, which dereferences a pointer obtained from an unchecked error path. An unauthenticated remote attacker can crash the entire server process with a single HTTP request to the /api/auth/local/recover endpoint. The vulnerability is classified under CWE-476 and affects the availability of the application without requiring authentication or user interaction.

Critical Impact
A single unauthenticated HTTP request to the account recovery endpoint terminates the FastSchema server process, causing a full denial of service.

Affected Products

FastSchema through v0.15.1
FastSchema local authentication module (pkg/auth/local.go)
Applications exposing the /api/auth/local/recover endpoint

Discovery Timeline

2026-08-10 - CVE-2026-72582 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72582

Vulnerability Analysis

The vulnerability affects the local authentication logic in FastSchema, a Go-based headless content management framework. When a client submits a recovery request to /api/auth/local/recover, the handler invokes the sendOTPEmail function. This function retrieves a value from an internal call that can return an error alongside a nil pointer. The code path fails to check the returned error before dereferencing the pointer.

The subsequent dereference triggers a fatal Go runtime panic. Because the panic occurs outside a recovered goroutine boundary, the Go runtime terminates the entire server process. All active sessions, in-flight requests, and background workers are lost. Restarting the process does not remediate the underlying flaw, and attackers can repeat the request to keep the service offline.

Root Cause

The root cause is missing error handling in the sendOTPEmail function in pkg/auth/local.go. Go idiomatic error handling requires callers to inspect the returned error value before using any accompanying result. In this case, the returned pointer is dereferenced directly, which corresponds to [CWE-476: NULL Pointer Dereference]. Any input that causes the upstream call to return an error, such as a recovery request referencing a nonexistent user or an unconfigured mail transport, produces the nil pointer condition.

Attack Vector

Exploitation requires only network reachability to the FastSchema HTTP interface. The attacker sends a crafted POST request to /api/auth/local/recover containing input that triggers the error path. No credentials, tokens, or user interaction are required. Since the server terminates on panic, this yields immediate service unavailability. Details are described in prose because no verified proof-of-concept code is publicly available. See the FastSchema local auth source for the affected implementation.

Detection Methods for CVE-2026-72582

Indicators of Compromise

Unexpected FastSchema process termination logs containing a Go runtime error: invalid memory address or nil pointer dereference panic trace referencing sendOTPEmail or pkg/auth/local.go.
HTTP access logs showing POST requests to /api/auth/local/recover followed immediately by service downtime or process supervisor restart events.
Repeated recovery requests from the same client IP or user agent across short intervals.

Detection Strategies

Alert on Go runtime panic stack traces that include pkg/auth/local.go in the FastSchema application logs.
Correlate application process exit events with recent inbound requests to /api/auth/local/recover to identify triggering payloads.
Track anomalous rates of 5xx responses or connection resets on the FastSchema HTTP listener.

Monitoring Recommendations

Ship FastSchema stdout, stderr, and access logs to a centralized log platform with retention sufficient for post-incident analysis.
Configure process supervisor restart-count alerts to surface repeated crashes rather than silently restarting the service.
Monitor HTTP 5xx and connection-reset rates on the reverse proxy fronting FastSchema.

How to Mitigate CVE-2026-72582

Immediate Actions Required

Restrict network access to the /api/auth/local/recover endpoint using a reverse proxy or web application firewall until a patched build is deployed.
Rate-limit requests to the local authentication endpoints to reduce the impact of repeated crash attempts.
Ensure FastSchema runs under a supervisor such as systemd with automatic restart and backoff configured.
Review application logs for prior panic traces referencing sendOTPEmail to determine whether exploitation has already occurred.

Patch Information

At time of publication, no fixed release is referenced in the NVD entry beyond the affected range through v0.15.1. Monitor the FastSchema GitHub repository for a release that adds an error check before dereferencing the pointer in sendOTPEmail. Upgrade to the fixed version as soon as it is published.

Workarounds

Block or filter POST requests to /api/auth/local/recover at the reverse proxy if local password recovery is not required.
Disable the local authentication provider and require an external identity provider where feasible.
Apply a private build that adds a nil check on the pointer returned within sendOTPEmail before use.

bash

# Example nginx configuration to block the vulnerable endpoint
location = /api/auth/local/recover {
    return 403;
}