CVE-2026-63462: unleash < 7.5.2, >= 7.6.0, < 7.6.5, >= 8.0.0, < 8.0.2

Affected technology

unleash · < 7.5.2, >= 7.6.0, < 7.6.5, >= 8.0.0, < 8.0.2
Unleash

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.