CVE-2026-77856

Name of the Vulnerable Software and Affected Versions ash typescript versions 0.11.0 through 0.17.9

Description An unauthenticated attacker can cause a denial of service by exhausting the BEAM atom table, leading to a node abort. This occurs when the resolve typed struct field/2 function in lib/ash typescript/rpc/field processing/field selector.ex processes client-supplied typed struct field names. If a field name is not found in the reverse map, the system uses String.to atom/1 to create a permanent atom before verifying if the field exists. Since atoms are not garbage collected, sending numerous distinct names can fill the atom table until the virtual machine reaches its limit and crashes. This issue is present when an AshTypescript RPC endpoint is exposed over HTTP and at least one resource field is backed by an Ash.TypedStruct.

Recommendations Update ash typescript to version 0.18.0 or later.