CVE-2026-84856: Denial of Service in rowboatlabs rowboat
Description
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind.
CVSS v4.0
Score 6.9medium
Affected software
rowboatlabs
rowboat
cpe:2.3:a:rowboatlabs:rowboat:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in rowboatlabs rowboat up to version 0.9.1 involves the request.text/req.json function within the Composio Webhook Endpoint component. Manipulating this function can cause a denial of service condition remotely. The legacy Next.js app, which contained the vulnerable code, was deleted in version 0.9.2 rather than patched, effectively removing the vulnerable component and mitigating the issue.
Potential Impact
Exploitation of this vulnerability results in denial of service, potentially disrupting availability of the affected service. The attack can be launched remotely without authentication or user interaction, increasing the risk of impact. No evidence of active exploitation in the wild is reported.
Mitigation Recommendations
Upgrade to rowboatlabs rowboat version 0.9.2 or later, which removes the vulnerable legacy Next.js app and resolves the issue. This upgrade is the recommended and sufficient remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-02T13:21:31.887Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a987e89acd9273b49a9f1a8
Added to database: 09/02/2026, 19:52:41 UTC
Last enriched: 09/07/2026, 13:09:17 UTC
Last updated: 10/17/2026, 18:48:23 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.