This vulnerability in evanchiu serverless-todo 1.0.3 and 2.0.0 involves the saveTodos function in src/index.js of the API Todo Endpoint. By manipulating the event.body argument, an attacker can cause excessive resource consumption. The flaw is remotely exploitable without authentication, and public exploit code exists. The vendor has not responded or provided a patch as of the publication date.

Successful exploitation can lead to resource exhaustion on the server running the vulnerable saveTodos function, potentially degrading service availability or causing denial of service. There is no indication of privilege escalation, data leakage, or code execution. The vulnerability is remotely exploitable without user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, monitor official channels for updates. Until a patch is available, consider implementing rate limiting or input validation on the event.body parameter to mitigate resource consumption risks.