CVE-2026-63462: CVE-2026-63462: Unauthenticated Stack Overflow Denial of Service in Unleash Server

CVE-2026-63462: Unauthenticated Stack Overflow Denial of Service in Unleash Server

Vulnerability ID: CVE-2026-63462
CVSS Score: 7.5
Published: 2026-08-21

An unauthenticated remote denial of service vulnerability exists in the Unleash feature management platform. By submitting a crafted JSON payload containing deeply nested structures to an OpenAPI-validated endpoint, an attacker can trigger uncontrolled recursion within the error formatting module. This leads to a call-stack exhaustion (RangeError: Maximum call stack size exceeded) inside the Node.js runtime, causing the service to crash immediately without recovery.

TL;DR

Unauthenticated remote attackers can crash the Unleash server with a single ~10 KB nested JSON request, causing immediate and complete denial of service.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-674 (Uncontrolled Recursion)
• Attack Vector: Network
• CVSS Score: 7.5 (High)
• Exploit Status: Proof of Concept available
• Impact: Complete Denial of Service (DoS)
• KEV Status: Not listed

Affected Systems

• Unleash feature management server
• Unleash Server: < 7.5.2 (Fixed in: 7.5.2)
• Unleash Server: >= 7.6.0, < 7.6.5 (Fixed in: 7.6.5)
• Unleash Server: >= 8.0.0, < 8.0.2 (Fixed in: 8.0.2)

Code Analysis

Commit: b0e4da6

Introduce safeStringify to prevent unhandled call stack exceptions during validation logging

Commit: d45f99d

DoS mitigations integration

Commit: d862562

Addons validation checks integration

Exploit Details

• GitHub Security Advisory: Exploit methodology description and mitigation commits details

Mitigation Strategies

• Upgrade Unleash platform to non-vulnerable release branches
• Deploy Edge/WAF structural validation rules restricting JSON nesting depth
• Configure process supervisors to automatically restart terminated Node.js processes

Remediation Steps:

1. Analyze package.json to identify instances of unleash-server falling within affected ranges (< 7.5.2, 7.6.0-7.6.4, 8.0.0-8.0.1)
2. Update unleash-server dependency to v7.5.2, v7.6.5, or v8.0.2
3. Rebuild and redeploy the containerized application
4. Verify recovery mechanics by validating that systemd or Kubernetes restart policies are active

References

• GHSA Security Advisory
• NVD CVE-2026-63462 Analysis
• CVE.org Official Record

---

Read the full report for CVE-2026-63462 on our website for more details including interactive diagrams and full exploit analysis.