CVE-2026-90582: Serverless-Todo DOS Vulnerability

CVE-2026-90582 Overview

CVE-2026-90582 affects the evanchiu/serverless-todo project versions 1.0.3 and 2.0.0. The vulnerability resides in the saveTodos function within src/index.js, part of the API Todo Endpoint component. Attackers can manipulate the event.body argument to trigger uncontrolled resource consumption [CWE-400]. The attack is executable remotely without authentication or user interaction. A public exploit disclosure exists, and the maintainer was informed through an issue report but has not responded. The weakness maps to a denial of service condition through resource exhaustion in the serverless handler.

Critical Impact
Remote unauthenticated attackers can send crafted request bodies to the Todo API endpoint to consume backend resources, degrading availability of the serverless function and potentially inflating cloud invocation costs.

Affected Products

evanchiu serverless-todo 1.0.3
evanchiu serverless-todo 2.0.0
Component: API Todo Endpoint (src/index.js, function saveTodos)

Discovery Timeline

2026-09-13 - CVE-2026-90582 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90582

Vulnerability Analysis

The vulnerability is a Resource Exhaustion flaw in the saveTodos function of src/index.js. The function processes the incoming event.body payload from the API Todo Endpoint without enforcing sufficient limits on size or structural complexity. An unauthenticated remote client can submit crafted request bodies that cause the serverless handler to consume disproportionate CPU, memory, or execution time. Because the project runs as a serverless function, sustained abuse can also drive elevated invocation billing in addition to service degradation. VulDB records a public exploit disclosure, though the maintainer has not published a fix as of the last NVD update.

Root Cause

The root cause is missing input validation and resource governance in the saveTodos handler. The function trusts event.body and processes it without size caps, schema validation, or complexity guards. This falls under [CWE-400] Uncontrolled Resource Consumption. Serverless entry points that parse untrusted JSON without limits are particularly exposed because the runtime provides no default backpressure on request payload shape.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the exposed Todo API endpoint with a manipulated event.body. Repeated or oversized submissions exhaust runtime resources allocated to the function invocation. See the GitHub Issue #10 Discussion and the VulDB CVE-2026-90582 entry for the public technical write-up.

No verified exploit code available. Refer to the VulDB entry and the upstream
GitHub issue for technical details on the malicious event.body construction.

Detection Methods for CVE-2026-90582

Indicators of Compromise

Anomalous spikes in serverless function invocation duration or memory usage against the Todo API endpoint.
Repeated POST requests to the saveTodos route with abnormally large or deeply nested JSON payloads.
Increased Lambda or equivalent FaaS billing associated with the deployed serverless-todo stack.
Elevated 5xx responses or timeouts originating from src/index.js handler logs.

Detection Strategies

Instrument API Gateway or the fronting load balancer to log request body sizes and flag requests exceeding a defined threshold.
Enable structured logging in the saveTodos handler to capture payload size, parse time, and execution duration per invocation.
Correlate cloud provider function metrics (duration, memory, concurrency) with source IP volume to identify abuse patterns.

Monitoring Recommendations

Alert on function execution duration approaching the configured timeout, especially on the Todo endpoint.
Track per-source-IP request rates to the API endpoint and flag deviations from baseline.
Monitor cloud billing dashboards for unexpected invocation cost growth tied to the affected stack.

How to Mitigate CVE-2026-90582

Immediate Actions Required

Place the exposed API behind an API Gateway or WAF that enforces a strict maximum request body size.
Reject requests to the Todo endpoint that fail JSON schema validation before they reach saveTodos.
Apply rate limiting and per-client throttling on the saveTodos route.
If the endpoint is not required, disable public exposure until a vendor fix is available.

Patch Information

No vendor patch is available at the time of the last NVD update. The maintainer of evanchiu/serverless-todo has been notified through the upstream issue tracker but has not responded. Track the GitHub Serverless TODO Project and VulDB Vulnerability #403167 for remediation updates.

Workarounds

Enforce a body size limit (for example, 8 KB) at the API Gateway before invocation reaches the Lambda function.
Add server-side JSON schema validation to saveTodos and reject payloads with excessive depth, key counts, or array lengths.
Configure a low function timeout and memory ceiling to bound the impact of any single abusive request.
Deploy rate limiting per source IP and per API key on the Todo endpoint.

bash

# Example AWS API Gateway request validator and throttling configuration
aws apigateway update-stage \
  --rest-api-id <api-id> \
  --stage-name prod \
  --patch-operations \
    op=replace,path=/*/*/throttling/rateLimit,value=10 \
    op=replace,path=/*/*/throttling/burstLimit,value=20

# Enforce request body size limit via AWS WAF managed rule
aws wafv2 update-web-acl \
  --name serverless-todo-acl \
  --scope REGIONAL \
  --rules file://body-size-limit-rule.json