CVE-2026-74837

Name of the Vulnerable Software and Affected Versions ash typescript versions 0.1.0 through 0.17.9

Description An unauthenticated attacker can cause a denial of service by exhausting the BEAM atom table, leading to a node abort. This occurs because the convert to field atom/2 function in lib/ash typescript/field formatter.ex uses String.to atom/1 to convert client-supplied field names into atoms when no matching atom exists. The process involves parse input field/2, which attempts to resolve the name using String.to existing atom/1 but falls back to a plain string, which is then minted into a permanent atom. Since atoms are not garbage collected, providing numerous distinct field names via RPC field selection through AshTypescript.Rpc.FieldProcessing.FieldSelector will eventually fill the atom table. Additionally, providing a field name exceeding 255 characters triggers an uncaught SystemLimitError. The issue is reachable when the application exposes an AshTypescript RPC endpoint over HTTP, allowing input to reach AshTypescript.Rpc.run action/3.

Recommendations Update ash typescript to version 0.18.0 or later.