CVE-2026-90582 identifies a resource consumption vulnerability in evanchiu serverless-todo versions 1.0.3 and 2.0.0. The flaw is located in the saveTodos function within src/index.js of the API Todo Endpoint component. An attacker can remotely manipulate the event.body argument to cause excessive resource consumption, potentially impacting service availability. The vulnerability has been publicly disclosed, and exploit code is available, though no known exploitation in the wild has been reported. The project has been notified but has not responded or issued a fix.

The vulnerability allows remote attackers to cause resource exhaustion by manipulating the event.body argument in the saveTodos function, potentially leading to denial of service conditions. There is no impact on confidentiality or integrity according to the CVSS vector. The medium severity rating reflects the availability impact without privilege or user interaction requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. In the meantime, consider implementing rate limiting or input validation on the event.body parameter to mitigate resource consumption risks.