CVE-2026-63462

Name of the Vulnerable Software and Affected Versions Unleash versions prior to 7.5.2 Unleash versions prior to 7.6.5 Unleash versions prior to 8.0.2

Description An unauthenticated attacker can cause a complete service outage by sending a deeply nested JSON value (approximately 10 KB) to OpenAPI-validated endpoints. The issue occurs because the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify within the genericErrorMessage and fromOpenApiValidationErrors functions without guarding against stack exhaustion. This triggers a RangeError: Maximum call stack size exceeded in the openAPIValidationMiddleware, terminating the Node process. Affected endpoints include 'POST /edge/validate' and 'POST /edge/issue-token'.

Recommendations Update to version 7.5.2. Update to version 7.6.5. Update to version 8.0.2.