Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.

A denial-of-service vulnerability exists in Unleash, an open-source feature management platform, affecting versions prior to 7.5.2, 7.6.5, and 8.0.2. The flaw resides in src/lib/error/bad-data-error.ts, where raw request values from lodash.get are passed to JSON.stringify without guarding against stack exhaustion. An unauthenticated attacker can exploit this by sending a roughly 10 KB deeply nested JSON payload to OpenAPI-validated endpoints such as POST /edge/validate or POST /edge/issue-token. This triggers a RangeError: Maximum call stack size exceeded in the openAPIValidationMiddleware, which terminates the Node.js process entirely. No uncaughtException handler is present to recover the process, making the service unavailable. Replaying the malicious request can sustain a complete and prolonged service outage. The vulnerability has been patched in versions 7.5.2, 7.6.5, and 8.0.2.