CVE-2026-63462

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.

• CWE-674

• https://github.com/Unleash/unleash/commit/b0e4da63249a9403bc209e0581db223326cb8dcf
• https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1
• https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d
• https://github.com/Unleash/unleash/releases/tag/v7.5.2
• https://github.com/Unleash/unleash/releases/tag/v7.6.5
• https://github.com/Unleash/unleash/releases/tag/v8.0.2
• https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp
• https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp

Published

Aug 21, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63453Buffer overflow vulnerabilities exist in the command line in…7.2
• CVE-2026-63454An authenticated path traversal vulnerability exists in AOS-…7.2
• CVE-2026-63455Multiple vulnerabilities in the REST API interface of HPE Ne…9.8
• CVE-2026-63456Multiple vulnerabilities in the REST API interface of HPE Ne…9.8
• CVE-2026-63457A potential denial of service vulnerability exists in HPE In…6.5
• CVE-2026-6346Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…8.7
• CVE-2026-63464nebula-mesh is a self-hosted control plane for Slack Nebula …7.7
• CVE-2026-63466Unleash is an open-source feature management platform. Prior…4.1
• CVE-2026-6347Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…7.6
• CVE-2026-6348WinMatrix agent developed by Simopro Technology has a Missin…9.3
• CVE-2026-63481Hurl is a command line tool that runs and tests HTTP request…6.9
• CVE-2026-6349The  iSherlock developed by HGiga  has an OS Command Injecti…9.8