CVE-2026-77856: CWE-770 Allocation of Resources Without Limits or Throttling in ash-project ash_typescript
Description
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolve_typed_struct_field/2 in lib/ash_typescript/rpc/field_processing/field_selector.ex looks a client-supplied field name up in the typed struct's reverse map and, when it finds no match, falls back to String.to_atom/1. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit. This issue affects ash_typescript: from 0.11.0 before 0.18.0.
CVSS v4.0
Score 8.2high
Affected software
ash-project
ash_typescript
ash-project
ash_typescript
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the resolve_typed_struct_field/2 function in lib/ash_typescript/rpc/field_processing/field_selector.ex. When a client-supplied field name is not found in the typed struct's reverse map, the code falls back to String.to_atom/1, which creates a permanent atom. Since atoms are never garbage collected in the BEAM VM, an attacker can supply many unique field names to exhaust the atom table, causing the node to abort. This affects ash_typescript versions >=0.11.0 and <0.18.0.
Potential Impact
An unauthenticated attacker can cause a denial of service by exhausting the BEAM atom table, leading to the node aborting. This disrupts availability of the affected system running vulnerable versions of ash_typescript.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing the vulnerable functionality to untrusted clients or implement input validation to limit distinct field names. Monitor for updates from the ash-project regarding an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-08-30T17:30:01.406Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a963a79acd9273b491bc8c1
Added to database: 09/01/2026, 02:37:45 UTC
Last enriched: 09/07/2026, 14:52:54 UTC
Last updated: 10/15/2026, 18:48:23 UTC
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.